{"level":"info","ts":"2026-10-30T13:09:18.985Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-10-30T13:09:18.988Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-10-30T13:09:18.991Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-10-30T13:09:18.991Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-10-30T13:09:18.999Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-10-30T13:09:18.999Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-10-30T13:09:19.017Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-10-30T13:09:19.286Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-praxis-b-8f3cb8","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T13:04:37Z","generation":6,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"9a879a5d-11ed-4dc1-989e-395e7e9082ea\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T13:08:47Z"}],"name":"kuadrant-e2e-praxis-b-8f3cb8","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-praxis-b-8f3cb8","uid":"9a879a5d-11ed-4dc1-989e-395e7e9082ea"}],"resourceVersion":"81442","uid":"264544ef-b42d-42f9-9005-998cd7a3b12d"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"13332b1d9d41bdb8593c142d1f08dd5ca5cd8d1ea66f02357461be7a412da71d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-8f3cb8-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-8f3cb8\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__3a3a09bb\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-8f3cb8\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__3a3a09bb\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a3c30f98e95082a4d4c0422e4f1887ed0760ba3c231d9448a4178156f955e62e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"82b484662c71334a03d81e9e8c327891241fabe5f659ea2aff5d1bb675e396a5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-8f3cb8-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-8f3cb8\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__3a3a09bb\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-8f3cb8\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__3a3a09bb\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6d64f90ec842e13369f6529463f540d257504a96118cfb6d3abaf014c121b589\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5aac341bfaf9857392f6fbd6f49f43ddc8e1ccd55d8d4927c69edac479d33a5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-8f3cb8-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-8f3cb8\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__3a3a09bb\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-8f3cb8\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__3a3a09bb\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7b5ad88ad956dce9cef7eff5c96a4635eb9fbccd5b72bc2c15ca41b3001ffa92\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e8f13fdb197d8bd82782f7d255fd291394a1166cae423bb70ae806ef27a25ddd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-8f3cb8-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-8f3cb8\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__3a3a09bb\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-8f3cb8\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__3a3a09bb\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b0373a9ade98fbc74f894f2bc005487b2db399f2880aaa8d10d736adfe379e59\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8556b61f62ddd2542cae02325e453589fab0d6aace48324f1636e1f54d7e10b8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-8f3cb8-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-8f3cb8\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__3a3a09bb\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-8f3cb8\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__3a3a09bb\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8756ec6e808029a39b4c25d2ae4ba0977187b5bac1111a89678764f7a2039b30\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"58bf5ead1391121dd1f8d62c0b998f8baa8ff13cde8995edbc62919e0681dd30\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-8f3cb8-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-8f3cb8\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__3a3a09bb\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-8f3cb8\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__3a3a09bb\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b73a68d91854db424fff79d0a29aa7f3fa1da7aae6e645572d6202162bcef98a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-praxis-b-8f3cb8"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-praxis-b-8f3cb8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:09:19.540Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w1-7a590a","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T12:47:09Z","generation":37,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"59691ce6-45f9-466f-95b0-37ea51621f91\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T13:08:46Z"}],"name":"kuadrant-e2e-worker-w1-7a590a","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w1-7a590a","uid":"59691ce6-45f9-466f-95b0-37ea51621f91"}],"resourceVersion":"81428","uid":"bd8113b0-02c2-4ef6-ac7b-70f5da056591"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"089b88945c3f987cbd854645d335b1ed3f87d04e17e66f7e7d584e52c1c5293b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"782eb2b86655a7063ec50aeb50761ba028d5aff1c427b9c596182c02806eaa12\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2e367576ea8266051677e41fdcbf708227a0071dfb69638dc9f83fdd7d99ea86\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"abb38e7df8d6f08cddb11f57c793dd67cbfaa03e64e7203c1d0a6a9b4782282a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"393f2fdfebf241dcbaa0ae443b32e566084dad1b7c8cf4e6237de95a20ca10df\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"eccb2b7077041a6c5473fcb6f9dd58485e0f96567711421f1cea5cb80bfd0ccc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ab71c1c7c2dccd7c72591861016e3908312803953aee1a08f892ce78b33659fa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2458c735ddded8f7ebd5cdf1cfa73d33af85f1b4f5afa47ef1a360353df8c13e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a00bce455a8ba0c28f513d2cbb3426dff48ac572de4a180ceb56690724d00b35\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f93480a53e523b496c9412cfc58e7f75d121f2d651ea3172486dd7ddcc2ebf35\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4088f3063b27f9d26c95d8b4cc13218e60e59c7f63fece214340d3f0068f6909\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e8b2d8d9ec8f38b9b28942d9c36865b0222b1ca9d82d0f0809e2edc99917ff2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a736aff22b9f2c7af9549b13acf51819f8e99aa04b373d0fb5fbfff688b50cd2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"15900836e6f269b428a7ba51ef7d8dc0a7ca36c301a71f45a53f5f1c4a79ba0b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6cf8ff0bc2509d8cdb34100efac4ca00ad38423a4de09b25ae7f459379466a87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1a6fa01f3aa9c2d26611604900e9a0441bd093c5e19a824325c7f168cb47b11c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"36cb6cbb20273aad26612a19dd5f6c3efe2c9dd2c600f17ad0a915ef88d8b954\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"63b15ec160e5c3f65f606ccd476d6758762dc51865d27e9f2dc6d6ed47ec9551\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0ce7632c4354c0c227fddad698833ef251d10cefef7f25005691c0fadd7534b1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9e544a6ff3c5e4acbe799f06b93f4543c4988fff030e587768dfe9defb00adb0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3e115bb8bf2d55d71e7f9990370dc806ef02b0c5eb99439f32e357c379411367\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a065802be295503b7704c19b0b67b8359647e2add0f49d96146ed9826862d379\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a13d202396b9f03f9e7deb7b13b75b922053e1590d404210385aecaf73a5ca5f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cf188fd4e6d9497fe145323333d65c5de891abbe18df379b2c386769a6533c6f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d6490111a2bd671f3cc91af93da068c37ea6368b20512943eff2ebfeb9e7d117\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b7e6f5a5af1e174b1ee883237807902e5e8d83f39a3be55b585d44cdbecff572\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4ad3ddfc2a3be8b29229c40c95a4b848a9ba651d362feb03479f7b823e10f545\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"539d95d0b5c7e895aefe94233065bd18082830b3fea6a9277ca55a0da71340b3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8db81c68936ba298f790897b302b150bd12d2eec22154ddf944de0192d7f4b4c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c31eb0b4a50b2c61a2954216dce8a56e9cb3b868cf31d217e6d3d57c4b74fd9e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"09e967c8402e6e306f4b71e6a00f60bd434f2bce2c9d59dff1695d35697dc4dc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6aa87f2820fa15854a304fb36e50d7cee4820128539073fc15bb69753599e132\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3f89ae75a20ba19970a54ccc348cc608ebfca7566239d4f9b158f43febd42e55\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9eada5130b36b41e1e1266aa1092c165e97662a21634ed8ec0460d824bc7e7b9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ae63d00fa381b265866cb1b277633e2a155b94de180c6acefe93b77f7e35e7d3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bd16c47d55fdb5e0ae8240ed986c78707a88611b66b44fae5ab86cb758c215c2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e85025d98da554ebf7c487d2062eb7fa47a1b3d6adb7b480115a5ce4cefb0483\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"836df2ea33f6af85c72799cdb8019385010401c873eb9b12a0e6c749eeb56668\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8c4d0e21c666fd015a2db768ffb20bedac801efe539190c06ca7594e9010af8c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"41b85dccaa8cfcafa7d210e7cd2b1c31420b2b2efdf0b87f46a00d62669b0727\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c92a5de0eff7788429bc28fdec8d86609bf02b5fbedce82308479d1706288bec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0ddfa7441f1dbf1ef599148ed77f7bc3072873b1ec449858709aa517261dff6a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"55e675544ade227ac183e9688220aab677d3e3a4d82332e06ed1f425d673a304\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"573b340bccee4a5264ad13b0495d2a6b1e723bb0fe81a6ea97352001ebc74284\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a149d9912ccbb2cd4dd7e07e1172f90c639e64a98b99b9a1967bc3c9bf5d8205\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"609ddabc6778b868f1f0bc5795c071230a76ff3193b26ff5dfa7be54b1c5a36f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"068abb543fe2d8904c85c4227e66d1127808e1da52374db674dc113c87dc522c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdd84071c7d83946e35acff99c9c5b580e876d0c4866c006f5f02e0a107cdd19\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9ce8c2fa3380caeba39c62cfdb2e02b46776e4eac1f908f418140d9b7b883fe2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3586b85b746666dda45c0149c8b212ef8c2b5c5169e2f39c5d3154b119922636\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a5785a5c9d1c12ba13cd603c475c38ef808a12f3823a420b722dc3d70a23c624\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"929ffee0abc41c7a806ffd074e4cfab69d7dfd28eb926dc373bad2330b28a299\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b457a46f3c297a562935e2446d9043cdc1001219a34f31aa169362f32a741476\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ad0f8be0fcd3482ffc4dcce070db2233c156a97a5caf0ba8f88af3eb9789ca93\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"10edd1ae6c0df8a5a1b0594a6fb7b99897fa2d890c87aa6828ecbf4c438a7e03\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6406218469c6248feb077866776924189ca35825c99557888fce19ff8ad56df6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f0f1429576f1a1be321185e1bd6abb819aea50327fda0269d5612db65c382cfd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"75caeb2fecf39c98a65022db57b8b7402a53d8e3bbbbd1058c2a1344df78adfc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4c7e28c4ea66d3867db6e2053d338fd95c76975fa4ce24e65e7850a19b58e263\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"51885626998fd07a952d2366626fa9c9042a4fcef22103bb3076cdc7d2e1e952\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"96a10edf633153472e430c6c2106fabd9d088950913cb891f8d1131e8e85d5da\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ed976c06c4ca362c858910c3dccd54c51c7d22e06a10186b205bc19289bb4d8f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9fcc31bf477a6a539b09c1dafa0d8c389f6af32511fb4c214235577254b96a22\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"04b63ca6998dad8b1e7eed5109e0fa6e6afcad35fbb0aa65553b2ee5aa7c8240\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3a378a4162f02d06b635ffcd9cd97fb7c9975eac68f0d956efd8c3576a6c096c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"559d1da3a3af0f4a6de89f3ed2ff6387393bc8df7d2069266776fab4a9e58b5d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"82a9c25434b61c4772a1ac29246cbb75b1b553266861c57cdeeb5d939581bbaa\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"268824ed95ae571b569392c28a2f752ebe783a99f1990997fbf3d40d303b735b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"df21e7cfc8f3ee440a1487e95ff0c570ae804b786dd01a0d794bd1f3a9985389\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"78b3f9dfb7975e736779a46c7634f04113fea0c5fea7f904b45d4e20a637b245\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d15c406a43328781f512c3e6de986a018b3122ac39a7a4cbc136e998b2b48492\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"76f0f35cf466cedfbe1e34a2e63b4cdd3526f8da2eb57738bb657765040daf5b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e3eeda6dee0071c64c151bbb71350df5353b1c91473127cebe525b54a04ae2cc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"223d764a35e77651bb2257681287c29021eb09722bfc90c7265d02c5ba32cf5e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f41fcbb289a766d6a29268d2be644d886254d678311240795320efb90fdad5eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8395b1e94560ed62d84241a4f665ffff31837260cc9aea35c39d3c05175e3026\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b42d2ea2a5c62b1cba47bae62d396ed1c6451087f098340f79cc1ed15366e415\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"12ea3d26783f57b1d94da52ab6a5901ce98ed4b15dec468549f4012dafa05a23\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"daeca0bfe6a614d446a745f7a44cc67f378c849fbedaa1026e4914166e275650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7fb3347fe6c52798901732dc2685b483e2f0c905d248d89deecc83d92553d1c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1cc8f595efea76e0d3eedd32969d77ea8835ab68928410c6c8b033bf46f72923\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d980c3fc378b4f381adb615552ff0fc69397031c7df24757a73c4edf99162fc0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0adc57d51b35181d57ce7070149cb9dcb5a1c35659398baa1c2c66f130cf379f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a8939b3047ea77ce4de1421d66edd7fbcabaf6b680b0966fae12c9f2b8db7f47\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1ae748d971f49d47d371205b68e94c4d734abb4b723a86bcb07504627759dc89\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1736265c5ca3ff6ef8615dbb050d5afa5d5f07e06104e6e51bb14c17e58043e6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"23aab9fbc666b3e1b9b9e93c16a3f2a3603bc75c70d345208c83efb52c885c12\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"daebbb1a2f4340f3d13a56b86dc4092ce39c6919fdc16213b9251d005dc65bb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"30449cf39f411e1cc4fa580c9f841e231a5d83f9d8c88b5c2dab8b705d0f2b52\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2d5c153474ffbe61aefeb835638d7c68a30f6a8885318889cc87590a7f453a0a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1031e5fe412033da350814ac517fe44eb0eae32dbb531ffb2414912a07a0c15f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9c50fa0064a87ebd762cb4ac0b4dc0e17c2eea32530860448d0a09c94b7e47cf\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eceaa3373eca8aa1fa797e413753c17981f4395ea7c9e6478abf3dbb81e8216b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"741d1c871aa8bc86392a31b6ba5abccc2350355d6463723ec4a6627598f3ddf9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cdf3e72f09d9c23ed7de62e42d53e35a45b58ea6979b92283ba6e44040223a64\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c315208fda098a36b225a63347f5fd4c7ec4c6a07535d21d4963c136d75dda8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f1891bb22a9e5664f3026841b58d9ab6c8ff3d4c1597f502e3c8daf82fd67c78\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b3baf3122d7f4fb81c398e67dce1c007a39d77c1b944b2eb6d102ea948b9366e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2906b56422a5d1e18029f8dfe9f583868b1f6413dbb86a0e4489258e2491aee2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea79ff6eb5f370812a6f750d2a475542d4729e79ab7de6f1e3b51b10c9ff15f4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"53525895e62d7603774165b95492f86a299a94e811b8bfa096068557dc3b7079\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0aabe65457a62852cbc3f5efd4c9afd908cc365b81ff4ccff45d69457999be4f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8efe4c813ac88cde94cfd4bea026c778ccd1fc314df55d6fc5a83b02e37d153e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a5e8be6e6efa0995666cde2b04ee89d684553a2c184ce9d65be941363760f6aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a8c66d50ffdf82d6ecae69a1c0971f324d61cb035754e672c09e1374920c130f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3a98a433d7e13f7037d129fb607c0aa6be8e2786ab529798075891f1caa2e2a6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9aa33d1f7ee5b6f87dfab107560c9553ff008f5f640805b76152726175c3c7a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ef747846c68074cb6f3e6a721fe746c946c0fd87b764ad0f32c0db14a530760c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"105f27cff377e7455202b357006b2ff9c435dd06d077a77766a438b920e65ecb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6ea9e47cbae52d5f98c27737783d0dc37f05ed89537af90900d99ba724786368\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b53dd5318f075895d6819e8d4ceffc9d62fa37419025365efad5d4c37c032ae2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a4fbcc35d3dd061cbfe1038d04f72a085a63f22e6e41e51732d576dcf511ae51\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"774123679310f86a6cee928712e1340beda60d2cfd92fbbd2c0879a79005ee42\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c845c4a191326e7c9ecf6da0b052a10671217a1380a0016bca9315386f48ca03\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dde723c1559b7f93ce7e2cffbcf1cf349ad8c296646082c81a7499be56862cd1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9d8f49969e71ac351537bf21d0ed0bc0dc5eb1695291c30737b293be5df9682f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"22b1883b4b523fcb5aa2347e32fc0852b420c0da88d30eb8ccec885b0647939d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9dc5ba2a85da2966998ed0d77f55d9da2820d7f5d7306991557614037e39a0cc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3a4b1c0e3136e893a0ff6adebc7676449cb25c1230b5628462c88499dc931fae\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c7c1445e34f1134341c70b2411f384cfef83a00287915d9a085d8ab6d61f0f5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c2af1523299b2ae906db2cfc1bc1eca9f96ff5bcf739238555d11eab67499efe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bd6ed37fff73ea134b5c2e7eef124891ca252106484efbdc80756cc354e3ea56\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"750010eae93e29ff523a99ba4e5ef57554664f3213920e75c1959e2db0176128\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7aac3b22be2aee4090a6d0cb32dd002d0fad5a689857d4e92ee03a950b30e0c9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"74883f5b7e7a852327e008c7e9f03a1d91f98325beeb19c446f62796e6aef8d1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4d1ea02979cfe39c600e55838846c4eee4ddc92bb7fcfb3453cd070bcf3e2959\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"44fc74b91f49727f317f3fdebe4dddd5445c63c7601b59dbb817a847a2a1b2eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a982cae2c9190837d5ea04d6ba343f2ddc2a96065c397c50678676b3e6e6c245\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8bf7acafa93e755f68cfd59460e5a54df9f18ca04f2d003d86d0083de64598fe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6200b66035d445a0e4c1702bf2414c2e8877c2f2c473277de2bc9f6e9bf2fe8e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"035ae7b4aacac45527bf36277a7aad77aa4acceba99af38797fa4f951905ee54\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"34cdd18da494efc76065ea82ac3395638e9aca5c40abbd53c0f4538612f07d35\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w1-7a590a"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w1-7a590a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:09:19.855Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w4-53dcb1","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T12:46:57Z","generation":41,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"ad19e696-52ed-4450-94f1-eded048bba27\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T13:08:47Z"}],"name":"kuadrant-e2e-worker-w4-53dcb1","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w4-53dcb1","uid":"ad19e696-52ed-4450-94f1-eded048bba27"}],"resourceVersion":"81436","uid":"9ec80002-b898-42ba-8857-784b6380ab66"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"25a1c9993b6f4ea69206eb6b230a0d5e752e689ebff241573f64cb0dcfed87bb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fdd2e931d0bc13263b903b61e1e009643cb3cb9f04728983f0a3ad1f80b17c2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05721040781acc43415365dffa14dcbb8008a73032f9fb4236838ae804f27cd9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7bc4fa4dc4148ac1b4dafbf544ddd9d141620d3c180513f76d642f7f7ec70af7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c5f2c0c7936757ece0bd2bc5d5d0172ca7760238d4a1aa4770798563e686071e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"08e10bd762ef9d277835f71d88a02ff17d9288d457fbc20c34f4c0fa61ace29e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0d0c5ad4cf5daf3340df7ec7bc02c0227878b43cc86f681eb8dceb836c188bac\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"77d288314f0282382ba31d8fff80ddccb1ca29df3066d00f7a2d9fc7cf6b06aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29ab17092352c0529d55cf050576da245a70dd62cec1da7912970150bd59a079\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbe36e82df47f6018446263f2720506e0888dad51ebdbd8a452aa39bab62320a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"de83e7795994116b47a6afcb4c300d56e6212f572909b311eebdae742b22db18\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2fa69e45d07440b1d4349b9a6603a14ca661a5cea439561e12cad2ab34bc3787\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c00658935c443bfc6b50aacecd40e2757e1434283a8ff1433611aebc4bfff347\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"99af2676f76182c413086a97bb31d9c67c509d7197fccbb26a9f72924cb9b153\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"865fe8edccec04f5fb55cdfef525c52c270ff0e4a7669ebd90714b892bc6b5ab\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4929a20f544b7005ce186874f90904640440dbf6bcf27f631412f6d0aaf65ee7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b1dfa4f975f7d58a22d462c662503f31664b7344d77150fc12167f31f05ca0a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"dba194f3dbcac655aebddfa3ea98dd2dd486760005d2ff2e87db3b2b445dd235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5905c63b7a6f8479c2bdf582769cf959048fe65bc9d0292d78dff259df383f54\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ac0b09d88152f12160535805c80002cbfb09c9925933ae43bd5d449357ff396a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"39d0af230c6555e4d3c2ee1dc247c36f417b1cc3502e3bed0a588e095410987f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ffef4b578a566be9626a99782a91b7ef0bea204cabe0bc69c5acd09f6c3673d7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a69418c064056026973af3a090f779fbb3dc3ee106c8054a7822cb4bdba759fb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6da0786f468dfd552ade1b11b8c3bfa854fff0f80cdd4b34fd451d8c50f0cf6d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6c547c2167c9135ebd65453f030b83b6bbbbb0e12fc95c7efa6b55331a01a81c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"520b3c828dbcc36acab6d0c5c97168f2df746cea294b070c48a25e4e9c26b26d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"84fcdcffb035aa4df026ea8b182c1d985c4deb171fb09264f5c2b78a7e290054\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"145d954305506b9fba35d76b2657c538b39d74dbeb078381aea86745b7bd64a7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"663790a0510f2693daf89340f00b57d9cb74a7e630de51e1f4e40f5759072963\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c9af5d5096c5c8e060feb79ccbf8348d2d5d819edf39a5dbafd4bd61c28de2b4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7e2454df0aada7fdd8ccd57fac150f260861e6c3472d5bdceeba2460b533958a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2b6f42efd682e1ea0376780340d0f60cef20eabdc177badf8c8ad46bf67daa6f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4c43f9d5f89223314ff24852e7f60990cdcffd391cae2e1728b63cb0cbd8e575\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b09bb280a4a5caa95494a0190d901dcb323926a950e611ffe112fe41c2586a6b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"46fc87d721087034978051b991603b15a1549a42ffd6a9f2d7540fa624d9fbe0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"07a9fbfd845551af5d7e8ad023ca8fb4bca991962b48191e7b9e7ec9f7c9410a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06644eed28a6354f9d9cbd205635366137e6f9a985e0cdf1f830923dc4c32196\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"68ecb87a9879d271a0377e0c71e8bb13fb86e8b9efb884649b22354c53bc0f98\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6ce786297e806878f759f8ebe30957c2bd515f34c8cd580c47396d68b73ee3d1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4806fdc003ab234e5613ac5978afcbb90ad7ee95e124d8b8b68bd3ae14a6a4dd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6ef9659353658fa30f8a50bb13e2e8523254919072f9604a5929a5ceb0a6bc17\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bab2aab3d0a190fbfe76a15bd83bb4d25567457a8ea53642a43efec9950c8eeb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2634d60d3fbc322f122dacc07b9e00083342e7efbe03e17bf65457a826752cf4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5aba94a69f9e6f9f49f506393b4e1f94dcc8c733a154a04211a09d4ccf02889a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eab745772fec776a6f0c7c817900ac89dcc6e3a8917a2bfb414cfb44d3d67989\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d017fd2c0c444c2a18f9ee008dc7cca88e7d3772c4747e4627cd4d1578552705\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"866ba8602385aeaa90e8ae78ada1be9ce63dd09727bf4ecc6c1fa758e828a9bd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"764f95faac255d6894c3b72c3b5d4b3310629e20f3a61e4a24f480cdbb534ccf\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"15ff23dabc113f8de56339b254a90e582a84646a03e6621c05d53289f469023b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f7c94f5addf2a5fafe55d76d5abac3e9e255c9e513b938166b26072dbbe1ff7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"006181ea19644569eba45d273bd8a4fc3b9b2bd4ecbd3ef11fbb23f3a488daba\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a8f18c80abda1bd84eb4ce7401df1b9272f767e6067d1caddc8d7e5560b270c0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8a140385139e5d1094af15ad091323d3ab199555833d87f4aab24de3d072b6e1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f262fc03d8702fd881d8cd47fe5dc53fa2b0caa758bc5f53e1504d4228b89af8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9daf1c7213c63158612c39c6292118e88db3ad9946191083ee2a5a5a42090281\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2d3d2ed379ff94f056ee47d557617cf8e11ef5e053dc91ae59462c063d6bc659\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1e238b7d9e3f5d63d4bb1b2c1e20a3b8446c915d602f4a498ff5e32b26494ce9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"86e5206ca9dda35199b03c7404f14484a0dc9345dc56aa254257dad3fe3045c9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9d94bdb074cd59e0eeb52465f57a2886f3010a3084bca915240c377dfa69371d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"76aef54a15f29a2d7e6a2e90a2bca69a7f7006d2cc855729cfcbe5ed2e20bce6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f09d09fc6dde1d236524d4d6dcb928bdcf139e1b1ce84cce5a5a61d0dfbe9a0d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cbb1929d83c87332ce3ac1c2c7eb219492bfa2b8f14a75142746a20f7533efb3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8013b4888d8c0c89f4fb91ca2c345624f24083cc7b8ea83841c85560e17fd789\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"800ccb9059fb2669e3e7f64e2570052f23cc34e2c5c2df30ea9c882f6a6563a5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"848ef614bc7f06bf3e510719cdaccc63c032f4baa9511a3271180a15243597be\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7538aa8fb0f19ce73bd49b0cf2cc2529f3177a4e22fd00f296706e6193c57c62\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b7fd9eb41424bdbacdb2d2be398f7f3d33ee8577e46641724bb6c847f8a39b50\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8d5f23b63daf3626d0e9d0e10d1d1a2ffbe77f04a3e9ef732a89194f8231d888\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"81e7bc6ff15c5fcf552436509b25c7dfb574a74e08c2e48ee54b9755f92fa90a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"57d7aec31d434be52f7b457c9fb3411b8bed4ba7dd552ddb9a03f4f751b80ce9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"11d94353721e19c51aa0bc6aaf17a915f0c4bc5c5b03c6670c645da71e67b0ab\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c341acb6cdaf59c82cf61b20358dd3839468045103db5ec5c628531e6da465b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e43587797a9f0e99f41485cc6382657fd275bc0456caa79ddfb81c0a3829ce8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"792380c647e80d86421f854ef1b85a93875b66898601b71c4cf2a2e944e593c0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e9a145d980170d0288208e686227f27cf4330221d68aa965fa696259630442c4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9650a227b189b38fd3967a878a7dad544dfa7c3ff95cfcd0a2a874103408d1c7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05daa6d986fd5a49c2023f2b7516d814e699fceafa44c99344553fea00c14848\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6537b6fcd48e7484cc289a8663ad12d6efb1403bebedd27c74627597b05f748b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"19bfec94f9532ea4b5b1ff4e22e34dccda05f7858053828e2a904551707f45dc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea2123826bcdce0fdce2c5a90727e1dd179d03b031c83f0b813d0ae63eb69677\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b7432eac2809c3393fb8b46df502f39f77e27e5e88eff0e8835bfdb185fa9eef\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8950dc33891bcf7b11610edf1c476c4ad48308a70ee7a0715a4ecc0200f0750c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5e2828e21483a361ca7af9667f8d2d5b6b368fff80e00b61868847aed179c479\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e54452bb832f5639f81eea8108710ae6b8208c72f43891f5d68e3738c7045204\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"104f9b7f51a3df1f9430904dedb3f7a4cf21c6cc4c20557200b5472ed316a34b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9ba0e3c245ec075a8ac59e90542272767b57e107405871ea949b889ee6539e55\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d277167c1aa8cacaa4008b08884917c3bf967bff3e5581e0d555489ad3f97e24\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"36062c03d9e26d06762aa1187aebb222e71f039151b2c623f6b5367983de7d70\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"671fede733c21121c0fa91b5b6cadbeceb86fb48425b13fa2b5f9d78803a82f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"407d064e9fb88cdc3971fe2d6bf8c9b1420f29af1ffc535d11bb7ed27b64ff42\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"282fb13e85739e757462864ee696b3b5e995491369e9a8b047440bf7e1681190\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3b93464ed862579d468647c5a4c3b4bb20cd49b9fbc1508ab9a76bc02c103875\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d23d6b45289810b57bcf4421cc3f6d7a9b00af854de8d617d6f29562dd513117\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8f0952e906a65a8f638e31655c86ef2b14fcb462735baf16d752c564ec3685f0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2a63b0542f7d5e9ab21ff2a70e875d9016c654a34be4af8b2862093443d15c51\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f87733d531f5c5ac690831f7810e82ab2fa83c91261b4620c531b6c1e2597408\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"17173ba26c2e665c9e0e4ef6ffc67fd759e864382b5cbe50edc98a2bdae7ddd4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"26b154581e3881356d524a47c977002fcebf8fc95f12b0fe9e16ff9bc93b6869\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b444fff7c731702df9c43dd18a342ed5f4b84acbd2ae2c04e246e2ddadc11c94\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7dd0d1de5baa211489652a3c15f430b8d98c560c8a2d48d601fecea8ef647fe0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7cd969c2f8771fba44a7e483980f071aa82ff99f59db04390ca78ff143e778c0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1428a708edeea422ef4b9716589806d329bf8845f820bfe5bc7178813f441d85\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"076a038410428b9ac2bad029581c01b28cffd7b7f1a64c56465ca488c625b3c5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4c02356413d5b89c13f5a61a96468b87adeed2b50bd1a06310c89906490d0ef4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"50f9f35158468854257f3b1da534aee4a02c5f37c0b91fe1a72899c341660094\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7b9be35bff6fdec58573ed2c1a1152fcbea438cef2475fc4cc9c903209a01c16\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4917cb32e7b2094a58f1559c0d805212c1f0a354154ff0d6718a8463e5565d99\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5504d0ebc213428e8e60ba1b109351cf7131650f3094706e423b22777e0a6a2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c2d72b7f90bb96f33e2e1b00416be5fdbcedf88bc9b8577dd76935f6319a4e60\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"595ee786cd23b52cf9e2dc51a3ee8f43ca72d2ecc929144b3271d8f106843faa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce47c00ef51de8c42dff484190186d5315e9812635a34ef8cbec474b4571879a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a75be581b7a86b2a2c0f39b442e1fa507ea04ff01e418ef580566cfbccf215d7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5b7b766a72874acf9e8163ee483bc3d2370257bc288a07afd179471595fc5c6d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b205f794a68f488c4a8f87b688181870575e9b6ca3b2a00df6f22524886338aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce573b3027ad9607006464b4e16f49dcac328bda3098dc2f9cbf0de48aa9d1a3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1c971719638c32dc812964dd616c6226115934f0909c7b85ed98644b854b3cb5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ebf2ac513888626165cd2d0790db586c2e4365bfc263ad07ac289ad50a7f0ae7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"489c62d558d8722de6ee3dcfd2c48a08927d2cdbf9949a248345c4f615f73f62\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9a0f225cd047dcdb3f4867b212ef3e6dec20d7e8a4fca7af06293fb5c507b2a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"91af9bbd342d70e7ded90a99ca79e9232c49add440a0baa7506ff0f8fcb7b531\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4f9ad3ea2cb0afdd240e7a999cacd6f99c830a43e8d5ae688123da58c428bec2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96425c7ab5b8711bc556881ccc5c39b9c0666aa833805063b33ba887d4a5a819\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8c0cd107e1fa6f004c9af05b8c3102f19ebfd173ca67bf6c06fdd17256eaba05\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0d3bea7d8f4148509a7b4fdd379c391351993a4406d93efebab9d2e3a0fb2cb6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"054858abf03d49266e8b2b24aacaec6285f09f0adfa2239155a173261bdcca7c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3df8116a7d69f8b78dff00107df12558b13101576f05fa1c19384020dc817adf\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"13caff03101ec8fb67cc6985c5efbc26b786120381d2d76f2515fdb6fe7706e9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"62b30c6ad3a9fcfa5ee595e3c4ec2739df9ba145321ad1f24428f133ada2d563\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d698cb3490c21dc5d10c6de9a6bc389ce436a75532ce382d151ae459332e57ee\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f8ea478a97a900e8d13e31f88e44d56eb6952feee907f3e774a95b8e3de26382\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3ae6be995c08f6214b9af6f7ee2efd55d8f0b2fb8b2e04829e5955c670b7b74d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"264d2df2ea589600cf328e148b762248ac5130839cf3859470c36a43292ff4b1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w4-53dcb1"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w4-53dcb1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:09:19.910Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-ipp-b-a81a48","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T13:01:58Z","generation":8,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"7247cae0-75c2-40d0-858a-37761962d582\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T13:08:47Z"}],"name":"kuadrant-e2e-ipp-b-a81a48","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-b-a81a48","uid":"7247cae0-75c2-40d0-858a-37761962d582"}],"resourceVersion":"81446","uid":"2041edfa-780f-478d-823e-27e867faf22b"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"21fecc486e57a32c50d4f47026b0d632ba45134f02a2c304bc907f3c8a791733\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-a81a48-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"def50d7b67db4f9ce9df8664738c10ae69cd6cde99cdd1bfe7c044aca653a5d4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f149e147e2fe9c57c6e10585c5471cb1512c355ef8816ca9157d7d7fbe903b73\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-a81a48-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7801afdb29734d08035302051226c3f876af04144286612bccf80d306d80ac7c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2a4217aa789a36cb16d6cd91eb134bb10187c9543f2a14b9881ed3ff2086ed43\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-a81a48-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"43add4377f15eb33a5e7501a3f847fa87622068f1ed030c83857f484af74712b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f4259abf025ff900a8e6974de118b312ba695f403d774481f8c355c65704001a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-a81a48-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9fd1a64d89ed030c3547135e21d9aa08db6146aad272d385d42deea43a24c571\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7dbd16246795ce835fca1423500f488e94b9f2b75dde5380a7d5d8c0694c3c97\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-a81a48-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1f46cdceb3343785c976f023237e6b8600530e65fa7875071f765f4326c8b433\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e03661c741a0057c8c424fd0de2da77448e9668191c686c1cfad5d575a18bab1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-a81a48-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8db9ac099165bdd2ca33059c73727e56afb800ee139d4b873f745d661213372d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-b-a81a48"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-ipp-b-a81a48\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:09:20.367Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T12:42:13Z","generation":32,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"13037da2-7ce3-408f-991b-ad31db53d1ff\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:44:45Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"13037da2-7ce3-408f-991b-ad31db53d1ff"}],"resourceVersion":"18597","uid":"044e9012-9183-4278-aac0-7fa080f81471"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"etcdserver: request is too large"}
{"level":"error","ts":"2026-10-30T13:09:20.394Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-53dcb1","namespace":"e2e-models-e2e-worker-w4-53dcb1","uid":"c38bfaf5-f2e6-48ca-82c3-93e2f72b5b36","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-53dcb1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:09:20.427Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny","namespace":"openshift-ingress","uid":"3ed0b548-54b3-4ca0-97cb-39f8824d0e4c","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:09:20.448Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"b3c72654-a441-46eb-b600-8f86b5d68e10","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:09:20.465Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"f97bdc32-b5c0-44fe-b3e8-9f6d2bf611ce","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:09:20.480Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-b-a81a48","namespace":"openshift-ingress","uid":"da70e898-3694-4670-90c3-d53aec414135","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-b-a81a48\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:09:20.496Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-worker-w4-53dcb1","namespace":"openshift-ingress","uid":"52e3229d-606f-4db7-98bc-956f208ede10","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-worker-w4-53dcb1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:09:20.511Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-53dcb1","namespace":"e2e-models-e2e-worker-w4-53dcb1","uid":"1092f88c-7f1b-4d74-9ba7-b9b0fd959b68","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-53dcb1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:09:20.528Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-7a590a","namespace":"e2e-models-e2e-worker-w1-7a590a","uid":"22506f20-f506-4553-8ba6-858d31792325","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-7a590a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:09:20.554Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-7a590a","namespace":"e2e-models-e2e-worker-w1-7a590a","uid":"f9af62f3-67ad-4018-8e68-d1b98a22aebf","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-7a590a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:09:20.571Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-b-8f3cb8","namespace":"openshift-ingress","uid":"730a7809-42dc-4a05-a9cd-2b52af5a524a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-b-8f3cb8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:09:20.587Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-worker-w1-7a590a","namespace":"openshift-ingress","uid":"a56a2bd0-df27-43de-8bc2-258da0283d97","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-worker-w1-7a590a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:09:20.588Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-10-30T13:09:20.588Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-10-30T13:09:20.670Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-a-4cb0fe","error":"gateways.gateway.networking.k8s.io \"e2e-praxis-a-4cb0fe\" not found"}
{"level":"info","ts":"2026-10-30T13:09:20.788Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"scheduling retry for non-blocking errors","errorCount":5,"requeueAfter":8}
{"level":"info","ts":"2026-10-30T13:09:22.812Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","EnvoyFilter","Limitador","HTTPRoute","ConfigMap","Gateway","TokenRateLimitPolicy","AuthConfig"],"eventTypes":{"delete":54,"update":14}}
{"level":"info","ts":"2026-10-30T13:09:22.843Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-10-30T13:09:22.843Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-10-30T13:09:23.582Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-10-30T13:09:23.592Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-10-30T13:09:23.691Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-10-30T13:09:23.691Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-10-30T13:09:24.411Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-10-30T13:09:24.470Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-10-30T13:09:24.474Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-10-30T13:09:24.474Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-10-30T13:09:24.479Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-10-30T13:09:24.479Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-10-30T13:09:24.486Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-10-30T13:09:26.314Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T12:42:13Z","generation":32,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"13037da2-7ce3-408f-991b-ad31db53d1ff\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:44:45Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"13037da2-7ce3-408f-991b-ad31db53d1ff"}],"resourceVersion":"18597","uid":"044e9012-9183-4278-aac0-7fa080f81471"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"etcdserver: request is too large"}
{"level":"info","ts":"2026-10-30T13:09:26.706Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-10-30T13:09:26.707Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-10-30T13:09:26.942Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"EnvoyFilter.networking.istio.io/openshift-ingress/kuadrant-e2e-praxis-b-8f3cb8/update","attempts":3,"duration":14.149749894}
{"level":"info","ts":"2026-10-30T13:09:26.943Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"EnvoyFilter.networking.istio.io/openshift-ingress/kuadrant-e2e-worker-w1-7a590a/update","attempts":3,"duration":14.149765761}
{"level":"info","ts":"2026-10-30T13:09:26.943Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"EnvoyFilter.networking.istio.io/openshift-ingress/kuadrant-e2e-worker-w4-53dcb1/update","attempts":3,"duration":14.14975921}
{"level":"info","ts":"2026-10-30T13:09:26.943Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"EnvoyFilter.networking.istio.io/openshift-ingress/kuadrant-e2e-ipp-b-a81a48/update","attempts":3,"duration":14.149771657}
{"level":"info","ts":"2026-10-30T13:09:26.943Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"scheduling retry for non-blocking errors","errorCount":1,"requeueAfter":32}
{"level":"info","ts":"2026-10-30T13:09:27.133Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","Kuadrant","TokenRateLimitPolicy","HTTPRoute","AuthPolicy","Gateway","EnvoyFilter","ConfigMap","Limitador"],"eventTypes":{"create":26,"delete":31,"update":125}}
{"level":"info","ts":"2026-10-30T13:09:27.205Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-10-30T13:09:27.223Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-10-30T13:09:28.530Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-10-30T13:09:28.581Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-10-30T13:09:28.596Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-10-30T13:09:28.596Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-10-30T13:09:28.596Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-10-30T13:09:29.812Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-10-30T13:09:29.816Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-10-30T13:09:29.816Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-10-30T13:09:29.871Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-10-30T13:09:29.876Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-10-30T13:09:29.876Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-10-30T13:09:29.877Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-10-30T13:09:29Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-8f3cb8","event":"UPDATE"}
{"level":"info","ts":"2026-10-30T13:09:29Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-10-30T13:09:29Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-10-30T13:09:29Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-10-30T13:09:30Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-10-30T13:09:30Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-8f3cb8","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-8f3cb8","reconcileID":"3f2c1a51-d4e3-4b89-9942-fe7ef6bbda0d","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-8f3cb8","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-10-30T13:09:30Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-8f3cb8","event":"DELETE"}
{"level":"info","ts":"2026-10-30T13:09:30Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-10-30T13:09:30Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-praxis-b-8f3cb8\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:445\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.23.3/pkg/internal/controller/controller.go:222\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.23.3/pkg/internal/controller/controller.go:479\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.23.3/pkg/internal/controller/controller.go:438\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func1.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.23.3/pkg/internal/controller/controller.go:313"}
{"level":"info","ts":"2026-10-30T13:09:30Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-10-30T13:09:30.171Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-ipp-b-a81a48","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T13:01:58Z","generation":9,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"7247cae0-75c2-40d0-858a-37761962d582\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T13:09:07Z"}],"name":"kuadrant-e2e-ipp-b-a81a48","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-b-a81a48","uid":"7247cae0-75c2-40d0-858a-37761962d582"}],"resourceVersion":"81867","uid":"2041edfa-780f-478d-823e-27e867faf22b"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"21fecc486e57a32c50d4f47026b0d632ba45134f02a2c304bc907f3c8a791733\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-a81a48-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"def50d7b67db4f9ce9df8664738c10ae69cd6cde99cdd1bfe7c044aca653a5d4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f149e147e2fe9c57c6e10585c5471cb1512c355ef8816ca9157d7d7fbe903b73\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-a81a48-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7801afdb29734d08035302051226c3f876af04144286612bccf80d306d80ac7c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2a4217aa789a36cb16d6cd91eb134bb10187c9543f2a14b9881ed3ff2086ed43\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-a81a48-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"43add4377f15eb33a5e7501a3f847fa87622068f1ed030c83857f484af74712b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f4259abf025ff900a8e6974de118b312ba695f403d774481f8c355c65704001a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-a81a48-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9fd1a64d89ed030c3547135e21d9aa08db6146aad272d385d42deea43a24c571\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7dbd16246795ce835fca1423500f488e94b9f2b75dde5380a7d5d8c0694c3c97\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-a81a48-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1f46cdceb3343785c976f023237e6b8600530e65fa7875071f765f4326c8b433\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e03661c741a0057c8c424fd0de2da77448e9668191c686c1cfad5d575a18bab1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-a81a48-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8db9ac099165bdd2ca33059c73727e56afb800ee139d4b873f745d661213372d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-b-a81a48"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-ipp-b-a81a48\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:09:30.215Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-praxis-b-8f3cb8","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T13:04:37Z","generation":7,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"9a879a5d-11ed-4dc1-989e-395e7e9082ea\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T13:09:05Z"}],"name":"kuadrant-e2e-praxis-b-8f3cb8","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-praxis-b-8f3cb8","uid":"9a879a5d-11ed-4dc1-989e-395e7e9082ea"}],"resourceVersion":"81837","uid":"264544ef-b42d-42f9-9005-998cd7a3b12d"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"13332b1d9d41bdb8593c142d1f08dd5ca5cd8d1ea66f02357461be7a412da71d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-8f3cb8-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-8f3cb8\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__3a3a09bb\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-8f3cb8\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__3a3a09bb\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a3c30f98e95082a4d4c0422e4f1887ed0760ba3c231d9448a4178156f955e62e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"82b484662c71334a03d81e9e8c327891241fabe5f659ea2aff5d1bb675e396a5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-8f3cb8-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-8f3cb8\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__3a3a09bb\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-8f3cb8\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__3a3a09bb\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6d64f90ec842e13369f6529463f540d257504a96118cfb6d3abaf014c121b589\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5aac341bfaf9857392f6fbd6f49f43ddc8e1ccd55d8d4927c69edac479d33a5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-8f3cb8-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-8f3cb8\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__3a3a09bb\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-8f3cb8\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__3a3a09bb\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7b5ad88ad956dce9cef7eff5c96a4635eb9fbccd5b72bc2c15ca41b3001ffa92\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e8f13fdb197d8bd82782f7d255fd291394a1166cae423bb70ae806ef27a25ddd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-8f3cb8-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-8f3cb8\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__3a3a09bb\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-8f3cb8\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__3a3a09bb\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b0373a9ade98fbc74f894f2bc005487b2db399f2880aaa8d10d736adfe379e59\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8556b61f62ddd2542cae02325e453589fab0d6aace48324f1636e1f54d7e10b8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-8f3cb8-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-8f3cb8\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__3a3a09bb\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-8f3cb8\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__3a3a09bb\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8756ec6e808029a39b4c25d2ae4ba0977187b5bac1111a89678764f7a2039b30\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"58bf5ead1391121dd1f8d62c0b998f8baa8ff13cde8995edbc62919e0681dd30\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-8f3cb8-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-8f3cb8\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__3a3a09bb\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-8f3cb8\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__3a3a09bb\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b73a68d91854db424fff79d0a29aa7f3fa1da7aae6e645572d6202162bcef98a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-praxis-b-8f3cb8"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-praxis-b-8f3cb8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:09:30.787Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T12:42:13Z","generation":32,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"13037da2-7ce3-408f-991b-ad31db53d1ff\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:44:45Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"13037da2-7ce3-408f-991b-ad31db53d1ff"}],"resourceVersion":"18597","uid":"044e9012-9183-4278-aac0-7fa080f81471"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"etcdserver: request is too large"}
{"level":"error","ts":"2026-10-30T13:09:31.040Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w1-7a590a","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T12:47:09Z","generation":38,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"59691ce6-45f9-466f-95b0-37ea51621f91\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T13:09:07Z"}],"name":"kuadrant-e2e-worker-w1-7a590a","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w1-7a590a","uid":"59691ce6-45f9-466f-95b0-37ea51621f91"}],"resourceVersion":"81864","uid":"bd8113b0-02c2-4ef6-ac7b-70f5da056591"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"089b88945c3f987cbd854645d335b1ed3f87d04e17e66f7e7d584e52c1c5293b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"782eb2b86655a7063ec50aeb50761ba028d5aff1c427b9c596182c02806eaa12\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2e367576ea8266051677e41fdcbf708227a0071dfb69638dc9f83fdd7d99ea86\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"abb38e7df8d6f08cddb11f57c793dd67cbfaa03e64e7203c1d0a6a9b4782282a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"393f2fdfebf241dcbaa0ae443b32e566084dad1b7c8cf4e6237de95a20ca10df\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"eccb2b7077041a6c5473fcb6f9dd58485e0f96567711421f1cea5cb80bfd0ccc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ab71c1c7c2dccd7c72591861016e3908312803953aee1a08f892ce78b33659fa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2458c735ddded8f7ebd5cdf1cfa73d33af85f1b4f5afa47ef1a360353df8c13e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a00bce455a8ba0c28f513d2cbb3426dff48ac572de4a180ceb56690724d00b35\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f93480a53e523b496c9412cfc58e7f75d121f2d651ea3172486dd7ddcc2ebf35\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4088f3063b27f9d26c95d8b4cc13218e60e59c7f63fece214340d3f0068f6909\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e8b2d8d9ec8f38b9b28942d9c36865b0222b1ca9d82d0f0809e2edc99917ff2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a736aff22b9f2c7af9549b13acf51819f8e99aa04b373d0fb5fbfff688b50cd2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"15900836e6f269b428a7ba51ef7d8dc0a7ca36c301a71f45a53f5f1c4a79ba0b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6cf8ff0bc2509d8cdb34100efac4ca00ad38423a4de09b25ae7f459379466a87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1a6fa01f3aa9c2d26611604900e9a0441bd093c5e19a824325c7f168cb47b11c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"36cb6cbb20273aad26612a19dd5f6c3efe2c9dd2c600f17ad0a915ef88d8b954\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"63b15ec160e5c3f65f606ccd476d6758762dc51865d27e9f2dc6d6ed47ec9551\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0ce7632c4354c0c227fddad698833ef251d10cefef7f25005691c0fadd7534b1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9e544a6ff3c5e4acbe799f06b93f4543c4988fff030e587768dfe9defb00adb0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3e115bb8bf2d55d71e7f9990370dc806ef02b0c5eb99439f32e357c379411367\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a065802be295503b7704c19b0b67b8359647e2add0f49d96146ed9826862d379\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a13d202396b9f03f9e7deb7b13b75b922053e1590d404210385aecaf73a5ca5f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cf188fd4e6d9497fe145323333d65c5de891abbe18df379b2c386769a6533c6f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d6490111a2bd671f3cc91af93da068c37ea6368b20512943eff2ebfeb9e7d117\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b7e6f5a5af1e174b1ee883237807902e5e8d83f39a3be55b585d44cdbecff572\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4ad3ddfc2a3be8b29229c40c95a4b848a9ba651d362feb03479f7b823e10f545\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"539d95d0b5c7e895aefe94233065bd18082830b3fea6a9277ca55a0da71340b3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8db81c68936ba298f790897b302b150bd12d2eec22154ddf944de0192d7f4b4c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c31eb0b4a50b2c61a2954216dce8a56e9cb3b868cf31d217e6d3d57c4b74fd9e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"09e967c8402e6e306f4b71e6a00f60bd434f2bce2c9d59dff1695d35697dc4dc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6aa87f2820fa15854a304fb36e50d7cee4820128539073fc15bb69753599e132\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3f89ae75a20ba19970a54ccc348cc608ebfca7566239d4f9b158f43febd42e55\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9eada5130b36b41e1e1266aa1092c165e97662a21634ed8ec0460d824bc7e7b9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ae63d00fa381b265866cb1b277633e2a155b94de180c6acefe93b77f7e35e7d3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bd16c47d55fdb5e0ae8240ed986c78707a88611b66b44fae5ab86cb758c215c2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e85025d98da554ebf7c487d2062eb7fa47a1b3d6adb7b480115a5ce4cefb0483\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"836df2ea33f6af85c72799cdb8019385010401c873eb9b12a0e6c749eeb56668\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8c4d0e21c666fd015a2db768ffb20bedac801efe539190c06ca7594e9010af8c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"41b85dccaa8cfcafa7d210e7cd2b1c31420b2b2efdf0b87f46a00d62669b0727\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c92a5de0eff7788429bc28fdec8d86609bf02b5fbedce82308479d1706288bec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0ddfa7441f1dbf1ef599148ed77f7bc3072873b1ec449858709aa517261dff6a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"55e675544ade227ac183e9688220aab677d3e3a4d82332e06ed1f425d673a304\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"573b340bccee4a5264ad13b0495d2a6b1e723bb0fe81a6ea97352001ebc74284\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a149d9912ccbb2cd4dd7e07e1172f90c639e64a98b99b9a1967bc3c9bf5d8205\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"609ddabc6778b868f1f0bc5795c071230a76ff3193b26ff5dfa7be54b1c5a36f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"068abb543fe2d8904c85c4227e66d1127808e1da52374db674dc113c87dc522c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdd84071c7d83946e35acff99c9c5b580e876d0c4866c006f5f02e0a107cdd19\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9ce8c2fa3380caeba39c62cfdb2e02b46776e4eac1f908f418140d9b7b883fe2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3586b85b746666dda45c0149c8b212ef8c2b5c5169e2f39c5d3154b119922636\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a5785a5c9d1c12ba13cd603c475c38ef808a12f3823a420b722dc3d70a23c624\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"929ffee0abc41c7a806ffd074e4cfab69d7dfd28eb926dc373bad2330b28a299\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b457a46f3c297a562935e2446d9043cdc1001219a34f31aa169362f32a741476\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ad0f8be0fcd3482ffc4dcce070db2233c156a97a5caf0ba8f88af3eb9789ca93\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"10edd1ae6c0df8a5a1b0594a6fb7b99897fa2d890c87aa6828ecbf4c438a7e03\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6406218469c6248feb077866776924189ca35825c99557888fce19ff8ad56df6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f0f1429576f1a1be321185e1bd6abb819aea50327fda0269d5612db65c382cfd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"75caeb2fecf39c98a65022db57b8b7402a53d8e3bbbbd1058c2a1344df78adfc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4c7e28c4ea66d3867db6e2053d338fd95c76975fa4ce24e65e7850a19b58e263\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"51885626998fd07a952d2366626fa9c9042a4fcef22103bb3076cdc7d2e1e952\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"96a10edf633153472e430c6c2106fabd9d088950913cb891f8d1131e8e85d5da\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ed976c06c4ca362c858910c3dccd54c51c7d22e06a10186b205bc19289bb4d8f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9fcc31bf477a6a539b09c1dafa0d8c389f6af32511fb4c214235577254b96a22\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"04b63ca6998dad8b1e7eed5109e0fa6e6afcad35fbb0aa65553b2ee5aa7c8240\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3a378a4162f02d06b635ffcd9cd97fb7c9975eac68f0d956efd8c3576a6c096c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"559d1da3a3af0f4a6de89f3ed2ff6387393bc8df7d2069266776fab4a9e58b5d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"82a9c25434b61c4772a1ac29246cbb75b1b553266861c57cdeeb5d939581bbaa\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"268824ed95ae571b569392c28a2f752ebe783a99f1990997fbf3d40d303b735b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"df21e7cfc8f3ee440a1487e95ff0c570ae804b786dd01a0d794bd1f3a9985389\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"78b3f9dfb7975e736779a46c7634f04113fea0c5fea7f904b45d4e20a637b245\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d15c406a43328781f512c3e6de986a018b3122ac39a7a4cbc136e998b2b48492\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"76f0f35cf466cedfbe1e34a2e63b4cdd3526f8da2eb57738bb657765040daf5b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e3eeda6dee0071c64c151bbb71350df5353b1c91473127cebe525b54a04ae2cc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"223d764a35e77651bb2257681287c29021eb09722bfc90c7265d02c5ba32cf5e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f41fcbb289a766d6a29268d2be644d886254d678311240795320efb90fdad5eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8395b1e94560ed62d84241a4f665ffff31837260cc9aea35c39d3c05175e3026\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b42d2ea2a5c62b1cba47bae62d396ed1c6451087f098340f79cc1ed15366e415\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"12ea3d26783f57b1d94da52ab6a5901ce98ed4b15dec468549f4012dafa05a23\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"daeca0bfe6a614d446a745f7a44cc67f378c849fbedaa1026e4914166e275650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7fb3347fe6c52798901732dc2685b483e2f0c905d248d89deecc83d92553d1c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1cc8f595efea76e0d3eedd32969d77ea8835ab68928410c6c8b033bf46f72923\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d980c3fc378b4f381adb615552ff0fc69397031c7df24757a73c4edf99162fc0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0adc57d51b35181d57ce7070149cb9dcb5a1c35659398baa1c2c66f130cf379f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a8939b3047ea77ce4de1421d66edd7fbcabaf6b680b0966fae12c9f2b8db7f47\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1ae748d971f49d47d371205b68e94c4d734abb4b723a86bcb07504627759dc89\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1736265c5ca3ff6ef8615dbb050d5afa5d5f07e06104e6e51bb14c17e58043e6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"23aab9fbc666b3e1b9b9e93c16a3f2a3603bc75c70d345208c83efb52c885c12\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"daebbb1a2f4340f3d13a56b86dc4092ce39c6919fdc16213b9251d005dc65bb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"30449cf39f411e1cc4fa580c9f841e231a5d83f9d8c88b5c2dab8b705d0f2b52\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2d5c153474ffbe61aefeb835638d7c68a30f6a8885318889cc87590a7f453a0a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1031e5fe412033da350814ac517fe44eb0eae32dbb531ffb2414912a07a0c15f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9c50fa0064a87ebd762cb4ac0b4dc0e17c2eea32530860448d0a09c94b7e47cf\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eceaa3373eca8aa1fa797e413753c17981f4395ea7c9e6478abf3dbb81e8216b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"741d1c871aa8bc86392a31b6ba5abccc2350355d6463723ec4a6627598f3ddf9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cdf3e72f09d9c23ed7de62e42d53e35a45b58ea6979b92283ba6e44040223a64\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c315208fda098a36b225a63347f5fd4c7ec4c6a07535d21d4963c136d75dda8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f1891bb22a9e5664f3026841b58d9ab6c8ff3d4c1597f502e3c8daf82fd67c78\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b3baf3122d7f4fb81c398e67dce1c007a39d77c1b944b2eb6d102ea948b9366e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2906b56422a5d1e18029f8dfe9f583868b1f6413dbb86a0e4489258e2491aee2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea79ff6eb5f370812a6f750d2a475542d4729e79ab7de6f1e3b51b10c9ff15f4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"53525895e62d7603774165b95492f86a299a94e811b8bfa096068557dc3b7079\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0aabe65457a62852cbc3f5efd4c9afd908cc365b81ff4ccff45d69457999be4f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8efe4c813ac88cde94cfd4bea026c778ccd1fc314df55d6fc5a83b02e37d153e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a5e8be6e6efa0995666cde2b04ee89d684553a2c184ce9d65be941363760f6aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a8c66d50ffdf82d6ecae69a1c0971f324d61cb035754e672c09e1374920c130f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3a98a433d7e13f7037d129fb607c0aa6be8e2786ab529798075891f1caa2e2a6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9aa33d1f7ee5b6f87dfab107560c9553ff008f5f640805b76152726175c3c7a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ef747846c68074cb6f3e6a721fe746c946c0fd87b764ad0f32c0db14a530760c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"105f27cff377e7455202b357006b2ff9c435dd06d077a77766a438b920e65ecb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6ea9e47cbae52d5f98c27737783d0dc37f05ed89537af90900d99ba724786368\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b53dd5318f075895d6819e8d4ceffc9d62fa37419025365efad5d4c37c032ae2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a4fbcc35d3dd061cbfe1038d04f72a085a63f22e6e41e51732d576dcf511ae51\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"774123679310f86a6cee928712e1340beda60d2cfd92fbbd2c0879a79005ee42\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c845c4a191326e7c9ecf6da0b052a10671217a1380a0016bca9315386f48ca03\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dde723c1559b7f93ce7e2cffbcf1cf349ad8c296646082c81a7499be56862cd1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9d8f49969e71ac351537bf21d0ed0bc0dc5eb1695291c30737b293be5df9682f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"22b1883b4b523fcb5aa2347e32fc0852b420c0da88d30eb8ccec885b0647939d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9dc5ba2a85da2966998ed0d77f55d9da2820d7f5d7306991557614037e39a0cc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3a4b1c0e3136e893a0ff6adebc7676449cb25c1230b5628462c88499dc931fae\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c7c1445e34f1134341c70b2411f384cfef83a00287915d9a085d8ab6d61f0f5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c2af1523299b2ae906db2cfc1bc1eca9f96ff5bcf739238555d11eab67499efe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bd6ed37fff73ea134b5c2e7eef124891ca252106484efbdc80756cc354e3ea56\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"750010eae93e29ff523a99ba4e5ef57554664f3213920e75c1959e2db0176128\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7aac3b22be2aee4090a6d0cb32dd002d0fad5a689857d4e92ee03a950b30e0c9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"74883f5b7e7a852327e008c7e9f03a1d91f98325beeb19c446f62796e6aef8d1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4d1ea02979cfe39c600e55838846c4eee4ddc92bb7fcfb3453cd070bcf3e2959\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"44fc74b91f49727f317f3fdebe4dddd5445c63c7601b59dbb817a847a2a1b2eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a982cae2c9190837d5ea04d6ba343f2ddc2a96065c397c50678676b3e6e6c245\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8bf7acafa93e755f68cfd59460e5a54df9f18ca04f2d003d86d0083de64598fe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6200b66035d445a0e4c1702bf2414c2e8877c2f2c473277de2bc9f6e9bf2fe8e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"035ae7b4aacac45527bf36277a7aad77aa4acceba99af38797fa4f951905ee54\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"34cdd18da494efc76065ea82ac3395638e9aca5c40abbd53c0f4538612f07d35\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w1-7a590a"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w1-7a590a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:09:31.274Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w4-53dcb1","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T12:46:57Z","generation":42,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"ad19e696-52ed-4450-94f1-eded048bba27\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T13:09:05Z"}],"name":"kuadrant-e2e-worker-w4-53dcb1","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w4-53dcb1","uid":"ad19e696-52ed-4450-94f1-eded048bba27"}],"resourceVersion":"81847","uid":"9ec80002-b898-42ba-8857-784b6380ab66"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"25a1c9993b6f4ea69206eb6b230a0d5e752e689ebff241573f64cb0dcfed87bb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fdd2e931d0bc13263b903b61e1e009643cb3cb9f04728983f0a3ad1f80b17c2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05721040781acc43415365dffa14dcbb8008a73032f9fb4236838ae804f27cd9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7bc4fa4dc4148ac1b4dafbf544ddd9d141620d3c180513f76d642f7f7ec70af7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c5f2c0c7936757ece0bd2bc5d5d0172ca7760238d4a1aa4770798563e686071e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"08e10bd762ef9d277835f71d88a02ff17d9288d457fbc20c34f4c0fa61ace29e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0d0c5ad4cf5daf3340df7ec7bc02c0227878b43cc86f681eb8dceb836c188bac\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"77d288314f0282382ba31d8fff80ddccb1ca29df3066d00f7a2d9fc7cf6b06aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29ab17092352c0529d55cf050576da245a70dd62cec1da7912970150bd59a079\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbe36e82df47f6018446263f2720506e0888dad51ebdbd8a452aa39bab62320a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"de83e7795994116b47a6afcb4c300d56e6212f572909b311eebdae742b22db18\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2fa69e45d07440b1d4349b9a6603a14ca661a5cea439561e12cad2ab34bc3787\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c00658935c443bfc6b50aacecd40e2757e1434283a8ff1433611aebc4bfff347\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"99af2676f76182c413086a97bb31d9c67c509d7197fccbb26a9f72924cb9b153\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"865fe8edccec04f5fb55cdfef525c52c270ff0e4a7669ebd90714b892bc6b5ab\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4929a20f544b7005ce186874f90904640440dbf6bcf27f631412f6d0aaf65ee7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b1dfa4f975f7d58a22d462c662503f31664b7344d77150fc12167f31f05ca0a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"dba194f3dbcac655aebddfa3ea98dd2dd486760005d2ff2e87db3b2b445dd235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5905c63b7a6f8479c2bdf582769cf959048fe65bc9d0292d78dff259df383f54\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ac0b09d88152f12160535805c80002cbfb09c9925933ae43bd5d449357ff396a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"39d0af230c6555e4d3c2ee1dc247c36f417b1cc3502e3bed0a588e095410987f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ffef4b578a566be9626a99782a91b7ef0bea204cabe0bc69c5acd09f6c3673d7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a69418c064056026973af3a090f779fbb3dc3ee106c8054a7822cb4bdba759fb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6da0786f468dfd552ade1b11b8c3bfa854fff0f80cdd4b34fd451d8c50f0cf6d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6c547c2167c9135ebd65453f030b83b6bbbbb0e12fc95c7efa6b55331a01a81c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"520b3c828dbcc36acab6d0c5c97168f2df746cea294b070c48a25e4e9c26b26d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"84fcdcffb035aa4df026ea8b182c1d985c4deb171fb09264f5c2b78a7e290054\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"145d954305506b9fba35d76b2657c538b39d74dbeb078381aea86745b7bd64a7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"663790a0510f2693daf89340f00b57d9cb74a7e630de51e1f4e40f5759072963\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c9af5d5096c5c8e060feb79ccbf8348d2d5d819edf39a5dbafd4bd61c28de2b4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7e2454df0aada7fdd8ccd57fac150f260861e6c3472d5bdceeba2460b533958a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2b6f42efd682e1ea0376780340d0f60cef20eabdc177badf8c8ad46bf67daa6f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4c43f9d5f89223314ff24852e7f60990cdcffd391cae2e1728b63cb0cbd8e575\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b09bb280a4a5caa95494a0190d901dcb323926a950e611ffe112fe41c2586a6b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"46fc87d721087034978051b991603b15a1549a42ffd6a9f2d7540fa624d9fbe0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"07a9fbfd845551af5d7e8ad023ca8fb4bca991962b48191e7b9e7ec9f7c9410a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06644eed28a6354f9d9cbd205635366137e6f9a985e0cdf1f830923dc4c32196\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"68ecb87a9879d271a0377e0c71e8bb13fb86e8b9efb884649b22354c53bc0f98\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6ce786297e806878f759f8ebe30957c2bd515f34c8cd580c47396d68b73ee3d1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4806fdc003ab234e5613ac5978afcbb90ad7ee95e124d8b8b68bd3ae14a6a4dd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6ef9659353658fa30f8a50bb13e2e8523254919072f9604a5929a5ceb0a6bc17\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bab2aab3d0a190fbfe76a15bd83bb4d25567457a8ea53642a43efec9950c8eeb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2634d60d3fbc322f122dacc07b9e00083342e7efbe03e17bf65457a826752cf4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5aba94a69f9e6f9f49f506393b4e1f94dcc8c733a154a04211a09d4ccf02889a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eab745772fec776a6f0c7c817900ac89dcc6e3a8917a2bfb414cfb44d3d67989\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d017fd2c0c444c2a18f9ee008dc7cca88e7d3772c4747e4627cd4d1578552705\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"866ba8602385aeaa90e8ae78ada1be9ce63dd09727bf4ecc6c1fa758e828a9bd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"764f95faac255d6894c3b72c3b5d4b3310629e20f3a61e4a24f480cdbb534ccf\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"15ff23dabc113f8de56339b254a90e582a84646a03e6621c05d53289f469023b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f7c94f5addf2a5fafe55d76d5abac3e9e255c9e513b938166b26072dbbe1ff7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"006181ea19644569eba45d273bd8a4fc3b9b2bd4ecbd3ef11fbb23f3a488daba\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a8f18c80abda1bd84eb4ce7401df1b9272f767e6067d1caddc8d7e5560b270c0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8a140385139e5d1094af15ad091323d3ab199555833d87f4aab24de3d072b6e1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f262fc03d8702fd881d8cd47fe5dc53fa2b0caa758bc5f53e1504d4228b89af8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9daf1c7213c63158612c39c6292118e88db3ad9946191083ee2a5a5a42090281\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2d3d2ed379ff94f056ee47d557617cf8e11ef5e053dc91ae59462c063d6bc659\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1e238b7d9e3f5d63d4bb1b2c1e20a3b8446c915d602f4a498ff5e32b26494ce9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"86e5206ca9dda35199b03c7404f14484a0dc9345dc56aa254257dad3fe3045c9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9d94bdb074cd59e0eeb52465f57a2886f3010a3084bca915240c377dfa69371d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"76aef54a15f29a2d7e6a2e90a2bca69a7f7006d2cc855729cfcbe5ed2e20bce6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f09d09fc6dde1d236524d4d6dcb928bdcf139e1b1ce84cce5a5a61d0dfbe9a0d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cbb1929d83c87332ce3ac1c2c7eb219492bfa2b8f14a75142746a20f7533efb3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8013b4888d8c0c89f4fb91ca2c345624f24083cc7b8ea83841c85560e17fd789\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"800ccb9059fb2669e3e7f64e2570052f23cc34e2c5c2df30ea9c882f6a6563a5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"848ef614bc7f06bf3e510719cdaccc63c032f4baa9511a3271180a15243597be\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7538aa8fb0f19ce73bd49b0cf2cc2529f3177a4e22fd00f296706e6193c57c62\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b7fd9eb41424bdbacdb2d2be398f7f3d33ee8577e46641724bb6c847f8a39b50\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8d5f23b63daf3626d0e9d0e10d1d1a2ffbe77f04a3e9ef732a89194f8231d888\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"81e7bc6ff15c5fcf552436509b25c7dfb574a74e08c2e48ee54b9755f92fa90a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"57d7aec31d434be52f7b457c9fb3411b8bed4ba7dd552ddb9a03f4f751b80ce9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"11d94353721e19c51aa0bc6aaf17a915f0c4bc5c5b03c6670c645da71e67b0ab\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c341acb6cdaf59c82cf61b20358dd3839468045103db5ec5c628531e6da465b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e43587797a9f0e99f41485cc6382657fd275bc0456caa79ddfb81c0a3829ce8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"792380c647e80d86421f854ef1b85a93875b66898601b71c4cf2a2e944e593c0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e9a145d980170d0288208e686227f27cf4330221d68aa965fa696259630442c4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9650a227b189b38fd3967a878a7dad544dfa7c3ff95cfcd0a2a874103408d1c7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05daa6d986fd5a49c2023f2b7516d814e699fceafa44c99344553fea00c14848\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6537b6fcd48e7484cc289a8663ad12d6efb1403bebedd27c74627597b05f748b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"19bfec94f9532ea4b5b1ff4e22e34dccda05f7858053828e2a904551707f45dc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea2123826bcdce0fdce2c5a90727e1dd179d03b031c83f0b813d0ae63eb69677\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b7432eac2809c3393fb8b46df502f39f77e27e5e88eff0e8835bfdb185fa9eef\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8950dc33891bcf7b11610edf1c476c4ad48308a70ee7a0715a4ecc0200f0750c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5e2828e21483a361ca7af9667f8d2d5b6b368fff80e00b61868847aed179c479\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e54452bb832f5639f81eea8108710ae6b8208c72f43891f5d68e3738c7045204\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"104f9b7f51a3df1f9430904dedb3f7a4cf21c6cc4c20557200b5472ed316a34b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9ba0e3c245ec075a8ac59e90542272767b57e107405871ea949b889ee6539e55\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d277167c1aa8cacaa4008b08884917c3bf967bff3e5581e0d555489ad3f97e24\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"36062c03d9e26d06762aa1187aebb222e71f039151b2c623f6b5367983de7d70\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"671fede733c21121c0fa91b5b6cadbeceb86fb48425b13fa2b5f9d78803a82f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"407d064e9fb88cdc3971fe2d6bf8c9b1420f29af1ffc535d11bb7ed27b64ff42\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"282fb13e85739e757462864ee696b3b5e995491369e9a8b047440bf7e1681190\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3b93464ed862579d468647c5a4c3b4bb20cd49b9fbc1508ab9a76bc02c103875\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d23d6b45289810b57bcf4421cc3f6d7a9b00af854de8d617d6f29562dd513117\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8f0952e906a65a8f638e31655c86ef2b14fcb462735baf16d752c564ec3685f0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2a63b0542f7d5e9ab21ff2a70e875d9016c654a34be4af8b2862093443d15c51\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f87733d531f5c5ac690831f7810e82ab2fa83c91261b4620c531b6c1e2597408\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"17173ba26c2e665c9e0e4ef6ffc67fd759e864382b5cbe50edc98a2bdae7ddd4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"26b154581e3881356d524a47c977002fcebf8fc95f12b0fe9e16ff9bc93b6869\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b444fff7c731702df9c43dd18a342ed5f4b84acbd2ae2c04e246e2ddadc11c94\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7dd0d1de5baa211489652a3c15f430b8d98c560c8a2d48d601fecea8ef647fe0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7cd969c2f8771fba44a7e483980f071aa82ff99f59db04390ca78ff143e778c0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1428a708edeea422ef4b9716589806d329bf8845f820bfe5bc7178813f441d85\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"076a038410428b9ac2bad029581c01b28cffd7b7f1a64c56465ca488c625b3c5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4c02356413d5b89c13f5a61a96468b87adeed2b50bd1a06310c89906490d0ef4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"50f9f35158468854257f3b1da534aee4a02c5f37c0b91fe1a72899c341660094\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7b9be35bff6fdec58573ed2c1a1152fcbea438cef2475fc4cc9c903209a01c16\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4917cb32e7b2094a58f1559c0d805212c1f0a354154ff0d6718a8463e5565d99\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5504d0ebc213428e8e60ba1b109351cf7131650f3094706e423b22777e0a6a2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c2d72b7f90bb96f33e2e1b00416be5fdbcedf88bc9b8577dd76935f6319a4e60\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"595ee786cd23b52cf9e2dc51a3ee8f43ca72d2ecc929144b3271d8f106843faa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce47c00ef51de8c42dff484190186d5315e9812635a34ef8cbec474b4571879a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a75be581b7a86b2a2c0f39b442e1fa507ea04ff01e418ef580566cfbccf215d7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5b7b766a72874acf9e8163ee483bc3d2370257bc288a07afd179471595fc5c6d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b205f794a68f488c4a8f87b688181870575e9b6ca3b2a00df6f22524886338aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce573b3027ad9607006464b4e16f49dcac328bda3098dc2f9cbf0de48aa9d1a3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1c971719638c32dc812964dd616c6226115934f0909c7b85ed98644b854b3cb5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ebf2ac513888626165cd2d0790db586c2e4365bfc263ad07ac289ad50a7f0ae7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"489c62d558d8722de6ee3dcfd2c48a08927d2cdbf9949a248345c4f615f73f62\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9a0f225cd047dcdb3f4867b212ef3e6dec20d7e8a4fca7af06293fb5c507b2a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"91af9bbd342d70e7ded90a99ca79e9232c49add440a0baa7506ff0f8fcb7b531\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4f9ad3ea2cb0afdd240e7a999cacd6f99c830a43e8d5ae688123da58c428bec2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96425c7ab5b8711bc556881ccc5c39b9c0666aa833805063b33ba887d4a5a819\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8c0cd107e1fa6f004c9af05b8c3102f19ebfd173ca67bf6c06fdd17256eaba05\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0d3bea7d8f4148509a7b4fdd379c391351993a4406d93efebab9d2e3a0fb2cb6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"054858abf03d49266e8b2b24aacaec6285f09f0adfa2239155a173261bdcca7c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3df8116a7d69f8b78dff00107df12558b13101576f05fa1c19384020dc817adf\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"13caff03101ec8fb67cc6985c5efbc26b786120381d2d76f2515fdb6fe7706e9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"62b30c6ad3a9fcfa5ee595e3c4ec2739df9ba145321ad1f24428f133ada2d563\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d698cb3490c21dc5d10c6de9a6bc389ce436a75532ce382d151ae459332e57ee\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f8ea478a97a900e8d13e31f88e44d56eb6952feee907f3e774a95b8e3de26382\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3ae6be995c08f6214b9af6f7ee2efd55d8f0b2fb8b2e04829e5955c670b7b74d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"264d2df2ea589600cf328e148b762248ac5130839cf3859470c36a43292ff4b1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w4-53dcb1"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w4-53dcb1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:09:31.457Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-b-8f3cb8","namespace":"openshift-ingress","uid":"730a7809-42dc-4a05-a9cd-2b52af5a524a","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-b-8f3cb8\" not found"}
{"level":"info","ts":"2026-10-30T13:09:31.474Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-10-30T13:09:31.474Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-10-30T13:09:31.507Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-a-026c2f","error":"gateways.gateway.networking.k8s.io \"e2e-ipp-a-026c2f\" not found"}
{"level":"error","ts":"2026-10-30T13:09:31.581Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-b-8f3cb8","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-praxis-b-8f3cb8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:09:31.624Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"IstioExtensionReconciler","operation":"update","resource":"openshift-ingress/kuadrant-e2e-ipp-b-a81a48","kind":"EnvoyFilter.networking.istio.io","error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-ipp-b-a81a48\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:09:31.624Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"IstioExtensionReconciler","operation":"update","resource":"openshift-ingress/kuadrant-e2e-praxis-b-8f3cb8","kind":"EnvoyFilter.networking.istio.io","error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-praxis-b-8f3cb8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:09:31.624Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"max retry attempts reached, giving up","source":"IstioExtensionReconciler","operation":"update","resource":"openshift-ingress/kuadrant-maas-default-gateway","kind":"EnvoyFilter.networking.istio.io","attempts":5,"duration":23.703333901,"error":"etcdserver: request is too large"}
{"level":"info","ts":"2026-10-30T13:09:31.624Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"IstioExtensionReconciler","operation":"update","resource":"openshift-ingress/kuadrant-e2e-worker-w1-7a590a","kind":"EnvoyFilter.networking.istio.io","error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w1-7a590a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:09:31.624Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"IstioExtensionReconciler","operation":"update","resource":"openshift-ingress/kuadrant-e2e-worker-w4-53dcb1","kind":"EnvoyFilter.networking.istio.io","error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w4-53dcb1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:09:31.624Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"scheduling retry for non-blocking errors","errorCount":4,"requeueAfter":2}
{"level":"info","ts":"2026-10-30T13:09:31.815Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","EnvoyFilter","Gateway","ConfigMap","HTTPRoute"],"eventTypes":{"delete":3,"update":17}}
{"level":"info","ts":"2026-10-30T13:09:31.910Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-10-30T13:09:32.400Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-10-30T13:09:33.317Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-10-30T13:09:33.370Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-10-30T13:09:33.370Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-10-30T13:09:33.374Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-10-30T13:09:33.374Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-10-30T13:09:33.376Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-10-30T13:09:33.376Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-10-30T13:09:33.685Z","logger":"kuadrant-operator.KuadrantController","msg":"triggering reconciliation retry for non-blocking errors","errorCount":4}
{"level":"error","ts":"2026-10-30T13:09:34.227Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T12:42:13Z","generation":32,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"13037da2-7ce3-408f-991b-ad31db53d1ff\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:44:45Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"13037da2-7ce3-408f-991b-ad31db53d1ff"}],"resourceVersion":"18597","uid":"044e9012-9183-4278-aac0-7fa080f81471"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"etcdserver: request is too large"}
{"level":"error","ts":"2026-10-30T13:09:34.483Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w4-53dcb1","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T12:46:57Z","generation":42,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"ad19e696-52ed-4450-94f1-eded048bba27\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T13:09:05Z"}],"name":"kuadrant-e2e-worker-w4-53dcb1","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w4-53dcb1","uid":"ad19e696-52ed-4450-94f1-eded048bba27"}],"resourceVersion":"81847","uid":"9ec80002-b898-42ba-8857-784b6380ab66"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"25a1c9993b6f4ea69206eb6b230a0d5e752e689ebff241573f64cb0dcfed87bb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fdd2e931d0bc13263b903b61e1e009643cb3cb9f04728983f0a3ad1f80b17c2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05721040781acc43415365dffa14dcbb8008a73032f9fb4236838ae804f27cd9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7bc4fa4dc4148ac1b4dafbf544ddd9d141620d3c180513f76d642f7f7ec70af7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c5f2c0c7936757ece0bd2bc5d5d0172ca7760238d4a1aa4770798563e686071e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"08e10bd762ef9d277835f71d88a02ff17d9288d457fbc20c34f4c0fa61ace29e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0d0c5ad4cf5daf3340df7ec7bc02c0227878b43cc86f681eb8dceb836c188bac\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"77d288314f0282382ba31d8fff80ddccb1ca29df3066d00f7a2d9fc7cf6b06aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29ab17092352c0529d55cf050576da245a70dd62cec1da7912970150bd59a079\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbe36e82df47f6018446263f2720506e0888dad51ebdbd8a452aa39bab62320a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"de83e7795994116b47a6afcb4c300d56e6212f572909b311eebdae742b22db18\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2fa69e45d07440b1d4349b9a6603a14ca661a5cea439561e12cad2ab34bc3787\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c00658935c443bfc6b50aacecd40e2757e1434283a8ff1433611aebc4bfff347\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"99af2676f76182c413086a97bb31d9c67c509d7197fccbb26a9f72924cb9b153\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"865fe8edccec04f5fb55cdfef525c52c270ff0e4a7669ebd90714b892bc6b5ab\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4929a20f544b7005ce186874f90904640440dbf6bcf27f631412f6d0aaf65ee7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b1dfa4f975f7d58a22d462c662503f31664b7344d77150fc12167f31f05ca0a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"dba194f3dbcac655aebddfa3ea98dd2dd486760005d2ff2e87db3b2b445dd235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5905c63b7a6f8479c2bdf582769cf959048fe65bc9d0292d78dff259df383f54\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ac0b09d88152f12160535805c80002cbfb09c9925933ae43bd5d449357ff396a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"39d0af230c6555e4d3c2ee1dc247c36f417b1cc3502e3bed0a588e095410987f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ffef4b578a566be9626a99782a91b7ef0bea204cabe0bc69c5acd09f6c3673d7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a69418c064056026973af3a090f779fbb3dc3ee106c8054a7822cb4bdba759fb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6da0786f468dfd552ade1b11b8c3bfa854fff0f80cdd4b34fd451d8c50f0cf6d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6c547c2167c9135ebd65453f030b83b6bbbbb0e12fc95c7efa6b55331a01a81c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"520b3c828dbcc36acab6d0c5c97168f2df746cea294b070c48a25e4e9c26b26d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"84fcdcffb035aa4df026ea8b182c1d985c4deb171fb09264f5c2b78a7e290054\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"145d954305506b9fba35d76b2657c538b39d74dbeb078381aea86745b7bd64a7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"663790a0510f2693daf89340f00b57d9cb74a7e630de51e1f4e40f5759072963\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c9af5d5096c5c8e060feb79ccbf8348d2d5d819edf39a5dbafd4bd61c28de2b4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7e2454df0aada7fdd8ccd57fac150f260861e6c3472d5bdceeba2460b533958a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2b6f42efd682e1ea0376780340d0f60cef20eabdc177badf8c8ad46bf67daa6f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4c43f9d5f89223314ff24852e7f60990cdcffd391cae2e1728b63cb0cbd8e575\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b09bb280a4a5caa95494a0190d901dcb323926a950e611ffe112fe41c2586a6b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"46fc87d721087034978051b991603b15a1549a42ffd6a9f2d7540fa624d9fbe0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"07a9fbfd845551af5d7e8ad023ca8fb4bca991962b48191e7b9e7ec9f7c9410a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06644eed28a6354f9d9cbd205635366137e6f9a985e0cdf1f830923dc4c32196\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"68ecb87a9879d271a0377e0c71e8bb13fb86e8b9efb884649b22354c53bc0f98\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6ce786297e806878f759f8ebe30957c2bd515f34c8cd580c47396d68b73ee3d1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4806fdc003ab234e5613ac5978afcbb90ad7ee95e124d8b8b68bd3ae14a6a4dd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6ef9659353658fa30f8a50bb13e2e8523254919072f9604a5929a5ceb0a6bc17\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bab2aab3d0a190fbfe76a15bd83bb4d25567457a8ea53642a43efec9950c8eeb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2634d60d3fbc322f122dacc07b9e00083342e7efbe03e17bf65457a826752cf4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5aba94a69f9e6f9f49f506393b4e1f94dcc8c733a154a04211a09d4ccf02889a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eab745772fec776a6f0c7c817900ac89dcc6e3a8917a2bfb414cfb44d3d67989\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d017fd2c0c444c2a18f9ee008dc7cca88e7d3772c4747e4627cd4d1578552705\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"866ba8602385aeaa90e8ae78ada1be9ce63dd09727bf4ecc6c1fa758e828a9bd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"764f95faac255d6894c3b72c3b5d4b3310629e20f3a61e4a24f480cdbb534ccf\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"15ff23dabc113f8de56339b254a90e582a84646a03e6621c05d53289f469023b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f7c94f5addf2a5fafe55d76d5abac3e9e255c9e513b938166b26072dbbe1ff7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"006181ea19644569eba45d273bd8a4fc3b9b2bd4ecbd3ef11fbb23f3a488daba\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a8f18c80abda1bd84eb4ce7401df1b9272f767e6067d1caddc8d7e5560b270c0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8a140385139e5d1094af15ad091323d3ab199555833d87f4aab24de3d072b6e1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f262fc03d8702fd881d8cd47fe5dc53fa2b0caa758bc5f53e1504d4228b89af8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9daf1c7213c63158612c39c6292118e88db3ad9946191083ee2a5a5a42090281\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2d3d2ed379ff94f056ee47d557617cf8e11ef5e053dc91ae59462c063d6bc659\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1e238b7d9e3f5d63d4bb1b2c1e20a3b8446c915d602f4a498ff5e32b26494ce9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"86e5206ca9dda35199b03c7404f14484a0dc9345dc56aa254257dad3fe3045c9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9d94bdb074cd59e0eeb52465f57a2886f3010a3084bca915240c377dfa69371d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"76aef54a15f29a2d7e6a2e90a2bca69a7f7006d2cc855729cfcbe5ed2e20bce6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f09d09fc6dde1d236524d4d6dcb928bdcf139e1b1ce84cce5a5a61d0dfbe9a0d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cbb1929d83c87332ce3ac1c2c7eb219492bfa2b8f14a75142746a20f7533efb3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8013b4888d8c0c89f4fb91ca2c345624f24083cc7b8ea83841c85560e17fd789\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"800ccb9059fb2669e3e7f64e2570052f23cc34e2c5c2df30ea9c882f6a6563a5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"848ef614bc7f06bf3e510719cdaccc63c032f4baa9511a3271180a15243597be\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7538aa8fb0f19ce73bd49b0cf2cc2529f3177a4e22fd00f296706e6193c57c62\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b7fd9eb41424bdbacdb2d2be398f7f3d33ee8577e46641724bb6c847f8a39b50\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8d5f23b63daf3626d0e9d0e10d1d1a2ffbe77f04a3e9ef732a89194f8231d888\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"81e7bc6ff15c5fcf552436509b25c7dfb574a74e08c2e48ee54b9755f92fa90a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"57d7aec31d434be52f7b457c9fb3411b8bed4ba7dd552ddb9a03f4f751b80ce9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"11d94353721e19c51aa0bc6aaf17a915f0c4bc5c5b03c6670c645da71e67b0ab\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c341acb6cdaf59c82cf61b20358dd3839468045103db5ec5c628531e6da465b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e43587797a9f0e99f41485cc6382657fd275bc0456caa79ddfb81c0a3829ce8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"792380c647e80d86421f854ef1b85a93875b66898601b71c4cf2a2e944e593c0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e9a145d980170d0288208e686227f27cf4330221d68aa965fa696259630442c4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9650a227b189b38fd3967a878a7dad544dfa7c3ff95cfcd0a2a874103408d1c7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05daa6d986fd5a49c2023f2b7516d814e699fceafa44c99344553fea00c14848\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6537b6fcd48e7484cc289a8663ad12d6efb1403bebedd27c74627597b05f748b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"19bfec94f9532ea4b5b1ff4e22e34dccda05f7858053828e2a904551707f45dc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea2123826bcdce0fdce2c5a90727e1dd179d03b031c83f0b813d0ae63eb69677\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b7432eac2809c3393fb8b46df502f39f77e27e5e88eff0e8835bfdb185fa9eef\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8950dc33891bcf7b11610edf1c476c4ad48308a70ee7a0715a4ecc0200f0750c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5e2828e21483a361ca7af9667f8d2d5b6b368fff80e00b61868847aed179c479\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e54452bb832f5639f81eea8108710ae6b8208c72f43891f5d68e3738c7045204\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"104f9b7f51a3df1f9430904dedb3f7a4cf21c6cc4c20557200b5472ed316a34b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9ba0e3c245ec075a8ac59e90542272767b57e107405871ea949b889ee6539e55\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d277167c1aa8cacaa4008b08884917c3bf967bff3e5581e0d555489ad3f97e24\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"36062c03d9e26d06762aa1187aebb222e71f039151b2c623f6b5367983de7d70\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"671fede733c21121c0fa91b5b6cadbeceb86fb48425b13fa2b5f9d78803a82f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"407d064e9fb88cdc3971fe2d6bf8c9b1420f29af1ffc535d11bb7ed27b64ff42\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"282fb13e85739e757462864ee696b3b5e995491369e9a8b047440bf7e1681190\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3b93464ed862579d468647c5a4c3b4bb20cd49b9fbc1508ab9a76bc02c103875\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d23d6b45289810b57bcf4421cc3f6d7a9b00af854de8d617d6f29562dd513117\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8f0952e906a65a8f638e31655c86ef2b14fcb462735baf16d752c564ec3685f0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2a63b0542f7d5e9ab21ff2a70e875d9016c654a34be4af8b2862093443d15c51\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f87733d531f5c5ac690831f7810e82ab2fa83c91261b4620c531b6c1e2597408\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"17173ba26c2e665c9e0e4ef6ffc67fd759e864382b5cbe50edc98a2bdae7ddd4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"26b154581e3881356d524a47c977002fcebf8fc95f12b0fe9e16ff9bc93b6869\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b444fff7c731702df9c43dd18a342ed5f4b84acbd2ae2c04e246e2ddadc11c94\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7dd0d1de5baa211489652a3c15f430b8d98c560c8a2d48d601fecea8ef647fe0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7cd969c2f8771fba44a7e483980f071aa82ff99f59db04390ca78ff143e778c0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1428a708edeea422ef4b9716589806d329bf8845f820bfe5bc7178813f441d85\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"076a038410428b9ac2bad029581c01b28cffd7b7f1a64c56465ca488c625b3c5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4c02356413d5b89c13f5a61a96468b87adeed2b50bd1a06310c89906490d0ef4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"50f9f35158468854257f3b1da534aee4a02c5f37c0b91fe1a72899c341660094\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7b9be35bff6fdec58573ed2c1a1152fcbea438cef2475fc4cc9c903209a01c16\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4917cb32e7b2094a58f1559c0d805212c1f0a354154ff0d6718a8463e5565d99\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5504d0ebc213428e8e60ba1b109351cf7131650f3094706e423b22777e0a6a2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c2d72b7f90bb96f33e2e1b00416be5fdbcedf88bc9b8577dd76935f6319a4e60\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"595ee786cd23b52cf9e2dc51a3ee8f43ca72d2ecc929144b3271d8f106843faa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce47c00ef51de8c42dff484190186d5315e9812635a34ef8cbec474b4571879a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a75be581b7a86b2a2c0f39b442e1fa507ea04ff01e418ef580566cfbccf215d7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5b7b766a72874acf9e8163ee483bc3d2370257bc288a07afd179471595fc5c6d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b205f794a68f488c4a8f87b688181870575e9b6ca3b2a00df6f22524886338aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce573b3027ad9607006464b4e16f49dcac328bda3098dc2f9cbf0de48aa9d1a3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1c971719638c32dc812964dd616c6226115934f0909c7b85ed98644b854b3cb5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ebf2ac513888626165cd2d0790db586c2e4365bfc263ad07ac289ad50a7f0ae7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"489c62d558d8722de6ee3dcfd2c48a08927d2cdbf9949a248345c4f615f73f62\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9a0f225cd047dcdb3f4867b212ef3e6dec20d7e8a4fca7af06293fb5c507b2a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"91af9bbd342d70e7ded90a99ca79e9232c49add440a0baa7506ff0f8fcb7b531\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4f9ad3ea2cb0afdd240e7a999cacd6f99c830a43e8d5ae688123da58c428bec2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96425c7ab5b8711bc556881ccc5c39b9c0666aa833805063b33ba887d4a5a819\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8c0cd107e1fa6f004c9af05b8c3102f19ebfd173ca67bf6c06fdd17256eaba05\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0d3bea7d8f4148509a7b4fdd379c391351993a4406d93efebab9d2e3a0fb2cb6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"054858abf03d49266e8b2b24aacaec6285f09f0adfa2239155a173261bdcca7c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3df8116a7d69f8b78dff00107df12558b13101576f05fa1c19384020dc817adf\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"13caff03101ec8fb67cc6985c5efbc26b786120381d2d76f2515fdb6fe7706e9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"62b30c6ad3a9fcfa5ee595e3c4ec2739df9ba145321ad1f24428f133ada2d563\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d698cb3490c21dc5d10c6de9a6bc389ce436a75532ce382d151ae459332e57ee\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f8ea478a97a900e8d13e31f88e44d56eb6952feee907f3e774a95b8e3de26382\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3ae6be995c08f6214b9af6f7ee2efd55d8f0b2fb8b2e04829e5955c670b7b74d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"264d2df2ea589600cf328e148b762248ac5130839cf3859470c36a43292ff4b1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w4-53dcb1"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w4-53dcb1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:09:34.524Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-praxis-b-8f3cb8","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T13:04:37Z","generation":7,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"9a879a5d-11ed-4dc1-989e-395e7e9082ea\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T13:09:05Z"}],"name":"kuadrant-e2e-praxis-b-8f3cb8","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-praxis-b-8f3cb8","uid":"9a879a5d-11ed-4dc1-989e-395e7e9082ea"}],"resourceVersion":"81837","uid":"264544ef-b42d-42f9-9005-998cd7a3b12d"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"13332b1d9d41bdb8593c142d1f08dd5ca5cd8d1ea66f02357461be7a412da71d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-8f3cb8-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-8f3cb8\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__3a3a09bb\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-8f3cb8\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__3a3a09bb\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a3c30f98e95082a4d4c0422e4f1887ed0760ba3c231d9448a4178156f955e62e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"82b484662c71334a03d81e9e8c327891241fabe5f659ea2aff5d1bb675e396a5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-8f3cb8-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-8f3cb8\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__3a3a09bb\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-8f3cb8\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__3a3a09bb\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6d64f90ec842e13369f6529463f540d257504a96118cfb6d3abaf014c121b589\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5aac341bfaf9857392f6fbd6f49f43ddc8e1ccd55d8d4927c69edac479d33a5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-8f3cb8-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-8f3cb8\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__3a3a09bb\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-8f3cb8\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__3a3a09bb\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7b5ad88ad956dce9cef7eff5c96a4635eb9fbccd5b72bc2c15ca41b3001ffa92\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e8f13fdb197d8bd82782f7d255fd291394a1166cae423bb70ae806ef27a25ddd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-8f3cb8-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-8f3cb8\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__3a3a09bb\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-8f3cb8\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__3a3a09bb\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b0373a9ade98fbc74f894f2bc005487b2db399f2880aaa8d10d736adfe379e59\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8556b61f62ddd2542cae02325e453589fab0d6aace48324f1636e1f54d7e10b8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-8f3cb8-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-8f3cb8\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__3a3a09bb\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-8f3cb8\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__3a3a09bb\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8756ec6e808029a39b4c25d2ae4ba0977187b5bac1111a89678764f7a2039b30\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"58bf5ead1391121dd1f8d62c0b998f8baa8ff13cde8995edbc62919e0681dd30\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-8f3cb8-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-8f3cb8\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__3a3a09bb\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-8f3cb8\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__3a3a09bb\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__3a3a09bb != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-8f3cb8\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b73a68d91854db424fff79d0a29aa7f3fa1da7aae6e645572d6202162bcef98a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-praxis-b-8f3cb8"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-praxis-b-8f3cb8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:09:34.565Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-ipp-b-a81a48","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T13:01:58Z","generation":9,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"7247cae0-75c2-40d0-858a-37761962d582\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T13:09:07Z"}],"name":"kuadrant-e2e-ipp-b-a81a48","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-b-a81a48","uid":"7247cae0-75c2-40d0-858a-37761962d582"}],"resourceVersion":"81867","uid":"2041edfa-780f-478d-823e-27e867faf22b"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"21fecc486e57a32c50d4f47026b0d632ba45134f02a2c304bc907f3c8a791733\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-a81a48-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"def50d7b67db4f9ce9df8664738c10ae69cd6cde99cdd1bfe7c044aca653a5d4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f149e147e2fe9c57c6e10585c5471cb1512c355ef8816ca9157d7d7fbe903b73\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-a81a48-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7801afdb29734d08035302051226c3f876af04144286612bccf80d306d80ac7c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2a4217aa789a36cb16d6cd91eb134bb10187c9543f2a14b9881ed3ff2086ed43\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-a81a48-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"43add4377f15eb33a5e7501a3f847fa87622068f1ed030c83857f484af74712b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f4259abf025ff900a8e6974de118b312ba695f403d774481f8c355c65704001a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-a81a48-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9fd1a64d89ed030c3547135e21d9aa08db6146aad272d385d42deea43a24c571\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7dbd16246795ce835fca1423500f488e94b9f2b75dde5380a7d5d8c0694c3c97\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-a81a48-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1f46cdceb3343785c976f023237e6b8600530e65fa7875071f765f4326c8b433\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e03661c741a0057c8c424fd0de2da77448e9668191c686c1cfad5d575a18bab1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-a81a48-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8db9ac099165bdd2ca33059c73727e56afb800ee139d4b873f745d661213372d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-b-a81a48"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-ipp-b-a81a48\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:09:34.981Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w1-7a590a","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T12:47:09Z","generation":38,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"59691ce6-45f9-466f-95b0-37ea51621f91\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T13:09:07Z"}],"name":"kuadrant-e2e-worker-w1-7a590a","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w1-7a590a","uid":"59691ce6-45f9-466f-95b0-37ea51621f91"}],"resourceVersion":"81864","uid":"bd8113b0-02c2-4ef6-ac7b-70f5da056591"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"089b88945c3f987cbd854645d335b1ed3f87d04e17e66f7e7d584e52c1c5293b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"782eb2b86655a7063ec50aeb50761ba028d5aff1c427b9c596182c02806eaa12\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2e367576ea8266051677e41fdcbf708227a0071dfb69638dc9f83fdd7d99ea86\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"abb38e7df8d6f08cddb11f57c793dd67cbfaa03e64e7203c1d0a6a9b4782282a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"393f2fdfebf241dcbaa0ae443b32e566084dad1b7c8cf4e6237de95a20ca10df\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"eccb2b7077041a6c5473fcb6f9dd58485e0f96567711421f1cea5cb80bfd0ccc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ab71c1c7c2dccd7c72591861016e3908312803953aee1a08f892ce78b33659fa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2458c735ddded8f7ebd5cdf1cfa73d33af85f1b4f5afa47ef1a360353df8c13e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a00bce455a8ba0c28f513d2cbb3426dff48ac572de4a180ceb56690724d00b35\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f93480a53e523b496c9412cfc58e7f75d121f2d651ea3172486dd7ddcc2ebf35\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4088f3063b27f9d26c95d8b4cc13218e60e59c7f63fece214340d3f0068f6909\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e8b2d8d9ec8f38b9b28942d9c36865b0222b1ca9d82d0f0809e2edc99917ff2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a736aff22b9f2c7af9549b13acf51819f8e99aa04b373d0fb5fbfff688b50cd2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"15900836e6f269b428a7ba51ef7d8dc0a7ca36c301a71f45a53f5f1c4a79ba0b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6cf8ff0bc2509d8cdb34100efac4ca00ad38423a4de09b25ae7f459379466a87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1a6fa01f3aa9c2d26611604900e9a0441bd093c5e19a824325c7f168cb47b11c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"36cb6cbb20273aad26612a19dd5f6c3efe2c9dd2c600f17ad0a915ef88d8b954\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"63b15ec160e5c3f65f606ccd476d6758762dc51865d27e9f2dc6d6ed47ec9551\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0ce7632c4354c0c227fddad698833ef251d10cefef7f25005691c0fadd7534b1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9e544a6ff3c5e4acbe799f06b93f4543c4988fff030e587768dfe9defb00adb0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3e115bb8bf2d55d71e7f9990370dc806ef02b0c5eb99439f32e357c379411367\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a065802be295503b7704c19b0b67b8359647e2add0f49d96146ed9826862d379\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a13d202396b9f03f9e7deb7b13b75b922053e1590d404210385aecaf73a5ca5f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cf188fd4e6d9497fe145323333d65c5de891abbe18df379b2c386769a6533c6f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d6490111a2bd671f3cc91af93da068c37ea6368b20512943eff2ebfeb9e7d117\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b7e6f5a5af1e174b1ee883237807902e5e8d83f39a3be55b585d44cdbecff572\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4ad3ddfc2a3be8b29229c40c95a4b848a9ba651d362feb03479f7b823e10f545\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"539d95d0b5c7e895aefe94233065bd18082830b3fea6a9277ca55a0da71340b3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8db81c68936ba298f790897b302b150bd12d2eec22154ddf944de0192d7f4b4c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c31eb0b4a50b2c61a2954216dce8a56e9cb3b868cf31d217e6d3d57c4b74fd9e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"09e967c8402e6e306f4b71e6a00f60bd434f2bce2c9d59dff1695d35697dc4dc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6aa87f2820fa15854a304fb36e50d7cee4820128539073fc15bb69753599e132\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3f89ae75a20ba19970a54ccc348cc608ebfca7566239d4f9b158f43febd42e55\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9eada5130b36b41e1e1266aa1092c165e97662a21634ed8ec0460d824bc7e7b9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ae63d00fa381b265866cb1b277633e2a155b94de180c6acefe93b77f7e35e7d3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bd16c47d55fdb5e0ae8240ed986c78707a88611b66b44fae5ab86cb758c215c2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e85025d98da554ebf7c487d2062eb7fa47a1b3d6adb7b480115a5ce4cefb0483\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"836df2ea33f6af85c72799cdb8019385010401c873eb9b12a0e6c749eeb56668\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8c4d0e21c666fd015a2db768ffb20bedac801efe539190c06ca7594e9010af8c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"41b85dccaa8cfcafa7d210e7cd2b1c31420b2b2efdf0b87f46a00d62669b0727\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c92a5de0eff7788429bc28fdec8d86609bf02b5fbedce82308479d1706288bec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0ddfa7441f1dbf1ef599148ed77f7bc3072873b1ec449858709aa517261dff6a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"55e675544ade227ac183e9688220aab677d3e3a4d82332e06ed1f425d673a304\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"573b340bccee4a5264ad13b0495d2a6b1e723bb0fe81a6ea97352001ebc74284\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a149d9912ccbb2cd4dd7e07e1172f90c639e64a98b99b9a1967bc3c9bf5d8205\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"609ddabc6778b868f1f0bc5795c071230a76ff3193b26ff5dfa7be54b1c5a36f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"068abb543fe2d8904c85c4227e66d1127808e1da52374db674dc113c87dc522c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdd84071c7d83946e35acff99c9c5b580e876d0c4866c006f5f02e0a107cdd19\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9ce8c2fa3380caeba39c62cfdb2e02b46776e4eac1f908f418140d9b7b883fe2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3586b85b746666dda45c0149c8b212ef8c2b5c5169e2f39c5d3154b119922636\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a5785a5c9d1c12ba13cd603c475c38ef808a12f3823a420b722dc3d70a23c624\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"929ffee0abc41c7a806ffd074e4cfab69d7dfd28eb926dc373bad2330b28a299\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b457a46f3c297a562935e2446d9043cdc1001219a34f31aa169362f32a741476\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ad0f8be0fcd3482ffc4dcce070db2233c156a97a5caf0ba8f88af3eb9789ca93\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"10edd1ae6c0df8a5a1b0594a6fb7b99897fa2d890c87aa6828ecbf4c438a7e03\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6406218469c6248feb077866776924189ca35825c99557888fce19ff8ad56df6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f0f1429576f1a1be321185e1bd6abb819aea50327fda0269d5612db65c382cfd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"75caeb2fecf39c98a65022db57b8b7402a53d8e3bbbbd1058c2a1344df78adfc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4c7e28c4ea66d3867db6e2053d338fd95c76975fa4ce24e65e7850a19b58e263\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"51885626998fd07a952d2366626fa9c9042a4fcef22103bb3076cdc7d2e1e952\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"96a10edf633153472e430c6c2106fabd9d088950913cb891f8d1131e8e85d5da\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ed976c06c4ca362c858910c3dccd54c51c7d22e06a10186b205bc19289bb4d8f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9fcc31bf477a6a539b09c1dafa0d8c389f6af32511fb4c214235577254b96a22\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"04b63ca6998dad8b1e7eed5109e0fa6e6afcad35fbb0aa65553b2ee5aa7c8240\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3a378a4162f02d06b635ffcd9cd97fb7c9975eac68f0d956efd8c3576a6c096c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"559d1da3a3af0f4a6de89f3ed2ff6387393bc8df7d2069266776fab4a9e58b5d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"82a9c25434b61c4772a1ac29246cbb75b1b553266861c57cdeeb5d939581bbaa\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"268824ed95ae571b569392c28a2f752ebe783a99f1990997fbf3d40d303b735b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"df21e7cfc8f3ee440a1487e95ff0c570ae804b786dd01a0d794bd1f3a9985389\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"78b3f9dfb7975e736779a46c7634f04113fea0c5fea7f904b45d4e20a637b245\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d15c406a43328781f512c3e6de986a018b3122ac39a7a4cbc136e998b2b48492\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"76f0f35cf466cedfbe1e34a2e63b4cdd3526f8da2eb57738bb657765040daf5b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e3eeda6dee0071c64c151bbb71350df5353b1c91473127cebe525b54a04ae2cc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"223d764a35e77651bb2257681287c29021eb09722bfc90c7265d02c5ba32cf5e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f41fcbb289a766d6a29268d2be644d886254d678311240795320efb90fdad5eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8395b1e94560ed62d84241a4f665ffff31837260cc9aea35c39d3c05175e3026\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b42d2ea2a5c62b1cba47bae62d396ed1c6451087f098340f79cc1ed15366e415\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"12ea3d26783f57b1d94da52ab6a5901ce98ed4b15dec468549f4012dafa05a23\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"daeca0bfe6a614d446a745f7a44cc67f378c849fbedaa1026e4914166e275650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7fb3347fe6c52798901732dc2685b483e2f0c905d248d89deecc83d92553d1c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1cc8f595efea76e0d3eedd32969d77ea8835ab68928410c6c8b033bf46f72923\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d980c3fc378b4f381adb615552ff0fc69397031c7df24757a73c4edf99162fc0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0adc57d51b35181d57ce7070149cb9dcb5a1c35659398baa1c2c66f130cf379f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a8939b3047ea77ce4de1421d66edd7fbcabaf6b680b0966fae12c9f2b8db7f47\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1ae748d971f49d47d371205b68e94c4d734abb4b723a86bcb07504627759dc89\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1736265c5ca3ff6ef8615dbb050d5afa5d5f07e06104e6e51bb14c17e58043e6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"23aab9fbc666b3e1b9b9e93c16a3f2a3603bc75c70d345208c83efb52c885c12\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"daebbb1a2f4340f3d13a56b86dc4092ce39c6919fdc16213b9251d005dc65bb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"30449cf39f411e1cc4fa580c9f841e231a5d83f9d8c88b5c2dab8b705d0f2b52\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2d5c153474ffbe61aefeb835638d7c68a30f6a8885318889cc87590a7f453a0a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1031e5fe412033da350814ac517fe44eb0eae32dbb531ffb2414912a07a0c15f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9c50fa0064a87ebd762cb4ac0b4dc0e17c2eea32530860448d0a09c94b7e47cf\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eceaa3373eca8aa1fa797e413753c17981f4395ea7c9e6478abf3dbb81e8216b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"741d1c871aa8bc86392a31b6ba5abccc2350355d6463723ec4a6627598f3ddf9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cdf3e72f09d9c23ed7de62e42d53e35a45b58ea6979b92283ba6e44040223a64\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c315208fda098a36b225a63347f5fd4c7ec4c6a07535d21d4963c136d75dda8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f1891bb22a9e5664f3026841b58d9ab6c8ff3d4c1597f502e3c8daf82fd67c78\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b3baf3122d7f4fb81c398e67dce1c007a39d77c1b944b2eb6d102ea948b9366e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2906b56422a5d1e18029f8dfe9f583868b1f6413dbb86a0e4489258e2491aee2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea79ff6eb5f370812a6f750d2a475542d4729e79ab7de6f1e3b51b10c9ff15f4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"53525895e62d7603774165b95492f86a299a94e811b8bfa096068557dc3b7079\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0aabe65457a62852cbc3f5efd4c9afd908cc365b81ff4ccff45d69457999be4f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8efe4c813ac88cde94cfd4bea026c778ccd1fc314df55d6fc5a83b02e37d153e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a5e8be6e6efa0995666cde2b04ee89d684553a2c184ce9d65be941363760f6aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a8c66d50ffdf82d6ecae69a1c0971f324d61cb035754e672c09e1374920c130f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3a98a433d7e13f7037d129fb607c0aa6be8e2786ab529798075891f1caa2e2a6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9aa33d1f7ee5b6f87dfab107560c9553ff008f5f640805b76152726175c3c7a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ef747846c68074cb6f3e6a721fe746c946c0fd87b764ad0f32c0db14a530760c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"105f27cff377e7455202b357006b2ff9c435dd06d077a77766a438b920e65ecb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6ea9e47cbae52d5f98c27737783d0dc37f05ed89537af90900d99ba724786368\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b53dd5318f075895d6819e8d4ceffc9d62fa37419025365efad5d4c37c032ae2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a4fbcc35d3dd061cbfe1038d04f72a085a63f22e6e41e51732d576dcf511ae51\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"774123679310f86a6cee928712e1340beda60d2cfd92fbbd2c0879a79005ee42\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c845c4a191326e7c9ecf6da0b052a10671217a1380a0016bca9315386f48ca03\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dde723c1559b7f93ce7e2cffbcf1cf349ad8c296646082c81a7499be56862cd1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9d8f49969e71ac351537bf21d0ed0bc0dc5eb1695291c30737b293be5df9682f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"22b1883b4b523fcb5aa2347e32fc0852b420c0da88d30eb8ccec885b0647939d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9dc5ba2a85da2966998ed0d77f55d9da2820d7f5d7306991557614037e39a0cc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3a4b1c0e3136e893a0ff6adebc7676449cb25c1230b5628462c88499dc931fae\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c7c1445e34f1134341c70b2411f384cfef83a00287915d9a085d8ab6d61f0f5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c2af1523299b2ae906db2cfc1bc1eca9f96ff5bcf739238555d11eab67499efe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bd6ed37fff73ea134b5c2e7eef124891ca252106484efbdc80756cc354e3ea56\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"750010eae93e29ff523a99ba4e5ef57554664f3213920e75c1959e2db0176128\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7aac3b22be2aee4090a6d0cb32dd002d0fad5a689857d4e92ee03a950b30e0c9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"74883f5b7e7a852327e008c7e9f03a1d91f98325beeb19c446f62796e6aef8d1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4d1ea02979cfe39c600e55838846c4eee4ddc92bb7fcfb3453cd070bcf3e2959\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"44fc74b91f49727f317f3fdebe4dddd5445c63c7601b59dbb817a847a2a1b2eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a982cae2c9190837d5ea04d6ba343f2ddc2a96065c397c50678676b3e6e6c245\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8bf7acafa93e755f68cfd59460e5a54df9f18ca04f2d003d86d0083de64598fe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6200b66035d445a0e4c1702bf2414c2e8877c2f2c473277de2bc9f6e9bf2fe8e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"035ae7b4aacac45527bf36277a7aad77aa4acceba99af38797fa4f951905ee54\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"34cdd18da494efc76065ea82ac3395638e9aca5c40abbd53c0f4538612f07d35\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w1-7a590a"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w1-7a590a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:09:35.025Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-b-8f3cb8","namespace":"openshift-ingress","uid":"730a7809-42dc-4a05-a9cd-2b52af5a524a","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-b-8f3cb8\" not found"}
{"level":"info","ts":"2026-10-30T13:09:35.179Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-10-30T13:09:35.179Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-10-30T13:09:35.272Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-a-026c2f","error":"gateways.gateway.networking.k8s.io \"e2e-ipp-a-026c2f\" not found"}
{"level":"error","ts":"2026-10-30T13:09:35.309Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-b-8f3cb8","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-praxis-b-8f3cb8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:09:35.330Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"IstioExtensionReconciler","operation":"update","resource":"openshift-ingress/kuadrant-maas-default-gateway","kind":"EnvoyFilter.networking.istio.io","error":"etcdserver: request is too large"}
{"level":"info","ts":"2026-10-30T13:09:35.330Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"scheduling retry for non-blocking errors","errorCount":5,"requeueAfter":2}
{"level":"info","ts":"2026-10-30T13:09:37.331Z","logger":"kuadrant-operator.KuadrantController","msg":"triggering reconciliation retry for non-blocking errors","errorCount":5}
{"level":"info","ts":"2026-10-30T13:09:37.399Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","Kuadrant","TokenRateLimitPolicy","HTTPRoute","AuthPolicy","Gateway","EnvoyFilter","ConfigMap","Limitador"],"eventTypes":{"create":26,"delete":31,"update":125}}
{"level":"info","ts":"2026-10-30T13:09:37.458Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-10-30T13:09:37.470Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-10-30T13:09:38.005Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-10-30T13:09:38.171Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-10-30T13:09:38.171Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-10-30T13:09:38.171Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-10-30T13:09:38.173Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-10-30T13:09:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-a81a48","event":"UPDATE"}
{"level":"info","ts":"2026-10-30T13:09:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-10-30T13:09:38Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-10-30T13:09:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-10-30T13:09:38Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-10-30T13:09:38Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-a81a48","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-a81a48","reconcileID":"9da94f73-98ee-44e0-b0d1-b4767bede206","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-a81a48","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-10-30T13:09:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-a81a48","event":"DELETE"}
{"level":"info","ts":"2026-10-30T13:09:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-10-30T13:09:38Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-ipp-b-a81a48\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:445\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.23.3/pkg/internal/controller/controller.go:222\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.23.3/pkg/internal/controller/controller.go:479\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.23.3/pkg/internal/controller/controller.go:438\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func1.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.23.3/pkg/internal/controller/controller.go:313"}
{"level":"info","ts":"2026-10-30T13:09:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-10-30T13:09:39.206Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-10-30T13:09:39.209Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-10-30T13:09:39.212Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-10-30T13:09:39.217Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-10-30T13:09:39.217Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-10-30T13:09:39.270Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-10-30T13:09:39.282Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-10-30T13:09:40.153Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T12:42:13Z","generation":32,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"13037da2-7ce3-408f-991b-ad31db53d1ff\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:44:45Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"13037da2-7ce3-408f-991b-ad31db53d1ff"}],"resourceVersion":"18597","uid":"044e9012-9183-4278-aac0-7fa080f81471"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"etcdserver: request is too large"}
{"level":"error","ts":"2026-10-30T13:09:41.272Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-praxis-b-8f3cb8-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-praxis-b-8f3cb8-maas-auth\" not found"}
{"level":"error","ts":"2026-10-30T13:09:41.298Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ipp-b-a81a48-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-ipp-b-a81a48-maas-auth\" not found"}
{"level":"error","ts":"2026-10-30T13:09:41.386Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-b-a81a48","namespace":"openshift-ingress","uid":"da70e898-3694-4670-90c3-d53aec414135","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-b-a81a48\" not found"}
{"level":"info","ts":"2026-10-30T13:09:41.490Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-10-30T13:09:41.490Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-10-30T13:09:41.690Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-b-a81a48","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-b-a81a48\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:09:41.691Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthPolicyStatusUpdater","operation":"update","resource":"openshift-ingress/e2e-praxis-b-8f3cb8-maas-auth","kind":"AuthPolicy.kuadrant.io","error":"authpolicies.kuadrant.io \"e2e-praxis-b-8f3cb8-maas-auth\" not found"}
{"level":"info","ts":"2026-10-30T13:09:41.691Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthPolicyStatusUpdater","operation":"update","resource":"openshift-ingress/e2e-ipp-b-a81a48-maas-auth","kind":"AuthPolicy.kuadrant.io","error":"authpolicies.kuadrant.io \"e2e-ipp-b-a81a48-maas-auth\" not found"}
{"level":"info","ts":"2026-10-30T13:09:41.691Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"EnvoyFilter.networking.istio.io/openshift-ingress/kuadrant-e2e-worker-w4-53dcb1/update","attempts":2,"duration":10.066393567}
{"level":"info","ts":"2026-10-30T13:09:41.691Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"EnvoyFilter.networking.istio.io/openshift-ingress/kuadrant-e2e-ipp-b-a81a48/update","attempts":2,"duration":10.066481382}
{"level":"info","ts":"2026-10-30T13:09:41.691Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"EnvoyFilter.networking.istio.io/openshift-ingress/kuadrant-e2e-praxis-b-8f3cb8/update","attempts":2,"duration":10.066492148}
{"level":"info","ts":"2026-10-30T13:09:41.691Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"EnvoyFilter.networking.istio.io/openshift-ingress/kuadrant-e2e-worker-w1-7a590a/update","attempts":2,"duration":10.066499123}
{"level":"info","ts":"2026-10-30T13:09:41.691Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"scheduling retry for non-blocking errors","errorCount":3,"requeueAfter":2}
{"level":"info","ts":"2026-10-30T13:09:41.904Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","Gateway","Kuadrant","ConfigMap","TokenRateLimitPolicy","HTTPRoute"],"eventTypes":{"delete":3,"update":7}}
{"level":"info","ts":"2026-10-30T13:09:41.961Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-10-30T13:09:41.981Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-10-30T13:09:43.231Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-10-30T13:09:43.307Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-10-30T13:09:43.307Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-10-30T13:09:43.441Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-10-30T13:09:43.710Z","logger":"kuadrant-operator.KuadrantController","msg":"triggering reconciliation retry for non-blocking errors","errorCount":3}
{"level":"info","ts":"2026-10-30T13:09:43.711Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-10-30T13:09:44.578Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-10-30T13:09:44.590Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-10-30T13:09:44.594Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-10-30T13:09:44.599Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-10-30T13:09:44.599Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-10-30T13:09:44.611Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-10-30T13:09:44.613Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:09:44.613Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-10-30T13:09:45.397Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T12:42:13Z","generation":32,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"13037da2-7ce3-408f-991b-ad31db53d1ff\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:44:45Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"13037da2-7ce3-408f-991b-ad31db53d1ff"}],"resourceVersion":"18597","uid":"044e9012-9183-4278-aac0-7fa080f81471"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"etcdserver: request is too large"}
{"level":"error","ts":"2026-10-30T13:09:45.444Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-ipp-b-a81a48","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T13:01:58Z","generation":10,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"7247cae0-75c2-40d0-858a-37761962d582\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T13:09:25Z"}],"name":"kuadrant-e2e-ipp-b-a81a48","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-b-a81a48","uid":"7247cae0-75c2-40d0-858a-37761962d582"}],"resourceVersion":"82476","uid":"2041edfa-780f-478d-823e-27e867faf22b"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"21fecc486e57a32c50d4f47026b0d632ba45134f02a2c304bc907f3c8a791733\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-a81a48-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"def50d7b67db4f9ce9df8664738c10ae69cd6cde99cdd1bfe7c044aca653a5d4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f149e147e2fe9c57c6e10585c5471cb1512c355ef8816ca9157d7d7fbe903b73\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-a81a48-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7801afdb29734d08035302051226c3f876af04144286612bccf80d306d80ac7c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2a4217aa789a36cb16d6cd91eb134bb10187c9543f2a14b9881ed3ff2086ed43\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-a81a48-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"43add4377f15eb33a5e7501a3f847fa87622068f1ed030c83857f484af74712b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f4259abf025ff900a8e6974de118b312ba695f403d774481f8c355c65704001a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-a81a48-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9fd1a64d89ed030c3547135e21d9aa08db6146aad272d385d42deea43a24c571\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7dbd16246795ce835fca1423500f488e94b9f2b75dde5380a7d5d8c0694c3c97\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-a81a48-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1f46cdceb3343785c976f023237e6b8600530e65fa7875071f765f4326c8b433\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e03661c741a0057c8c424fd0de2da77448e9668191c686c1cfad5d575a18bab1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-a81a48-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-a81a48\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__8603d73c\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__8603d73c != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-a81a48\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8db9ac099165bdd2ca33059c73727e56afb800ee139d4b873f745d661213372d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-b-a81a48"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-ipp-b-a81a48\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:09:45.688Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w4-53dcb1","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T12:46:57Z","generation":43,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"ad19e696-52ed-4450-94f1-eded048bba27\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T13:09:25Z"}],"name":"kuadrant-e2e-worker-w4-53dcb1","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w4-53dcb1","uid":"ad19e696-52ed-4450-94f1-eded048bba27"}],"resourceVersion":"82472","uid":"9ec80002-b898-42ba-8857-784b6380ab66"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"25a1c9993b6f4ea69206eb6b230a0d5e752e689ebff241573f64cb0dcfed87bb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fdd2e931d0bc13263b903b61e1e009643cb3cb9f04728983f0a3ad1f80b17c2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05721040781acc43415365dffa14dcbb8008a73032f9fb4236838ae804f27cd9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7bc4fa4dc4148ac1b4dafbf544ddd9d141620d3c180513f76d642f7f7ec70af7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c5f2c0c7936757ece0bd2bc5d5d0172ca7760238d4a1aa4770798563e686071e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"08e10bd762ef9d277835f71d88a02ff17d9288d457fbc20c34f4c0fa61ace29e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0d0c5ad4cf5daf3340df7ec7bc02c0227878b43cc86f681eb8dceb836c188bac\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"77d288314f0282382ba31d8fff80ddccb1ca29df3066d00f7a2d9fc7cf6b06aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29ab17092352c0529d55cf050576da245a70dd62cec1da7912970150bd59a079\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbe36e82df47f6018446263f2720506e0888dad51ebdbd8a452aa39bab62320a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"de83e7795994116b47a6afcb4c300d56e6212f572909b311eebdae742b22db18\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2fa69e45d07440b1d4349b9a6603a14ca661a5cea439561e12cad2ab34bc3787\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c00658935c443bfc6b50aacecd40e2757e1434283a8ff1433611aebc4bfff347\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"99af2676f76182c413086a97bb31d9c67c509d7197fccbb26a9f72924cb9b153\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"865fe8edccec04f5fb55cdfef525c52c270ff0e4a7669ebd90714b892bc6b5ab\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4929a20f544b7005ce186874f90904640440dbf6bcf27f631412f6d0aaf65ee7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b1dfa4f975f7d58a22d462c662503f31664b7344d77150fc12167f31f05ca0a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"dba194f3dbcac655aebddfa3ea98dd2dd486760005d2ff2e87db3b2b445dd235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5905c63b7a6f8479c2bdf582769cf959048fe65bc9d0292d78dff259df383f54\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ac0b09d88152f12160535805c80002cbfb09c9925933ae43bd5d449357ff396a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"39d0af230c6555e4d3c2ee1dc247c36f417b1cc3502e3bed0a588e095410987f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ffef4b578a566be9626a99782a91b7ef0bea204cabe0bc69c5acd09f6c3673d7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a69418c064056026973af3a090f779fbb3dc3ee106c8054a7822cb4bdba759fb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6da0786f468dfd552ade1b11b8c3bfa854fff0f80cdd4b34fd451d8c50f0cf6d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6c547c2167c9135ebd65453f030b83b6bbbbb0e12fc95c7efa6b55331a01a81c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"520b3c828dbcc36acab6d0c5c97168f2df746cea294b070c48a25e4e9c26b26d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"84fcdcffb035aa4df026ea8b182c1d985c4deb171fb09264f5c2b78a7e290054\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"145d954305506b9fba35d76b2657c538b39d74dbeb078381aea86745b7bd64a7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"663790a0510f2693daf89340f00b57d9cb74a7e630de51e1f4e40f5759072963\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c9af5d5096c5c8e060feb79ccbf8348d2d5d819edf39a5dbafd4bd61c28de2b4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7e2454df0aada7fdd8ccd57fac150f260861e6c3472d5bdceeba2460b533958a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2b6f42efd682e1ea0376780340d0f60cef20eabdc177badf8c8ad46bf67daa6f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4c43f9d5f89223314ff24852e7f60990cdcffd391cae2e1728b63cb0cbd8e575\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b09bb280a4a5caa95494a0190d901dcb323926a950e611ffe112fe41c2586a6b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"46fc87d721087034978051b991603b15a1549a42ffd6a9f2d7540fa624d9fbe0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"07a9fbfd845551af5d7e8ad023ca8fb4bca991962b48191e7b9e7ec9f7c9410a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06644eed28a6354f9d9cbd205635366137e6f9a985e0cdf1f830923dc4c32196\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"68ecb87a9879d271a0377e0c71e8bb13fb86e8b9efb884649b22354c53bc0f98\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6ce786297e806878f759f8ebe30957c2bd515f34c8cd580c47396d68b73ee3d1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4806fdc003ab234e5613ac5978afcbb90ad7ee95e124d8b8b68bd3ae14a6a4dd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6ef9659353658fa30f8a50bb13e2e8523254919072f9604a5929a5ceb0a6bc17\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bab2aab3d0a190fbfe76a15bd83bb4d25567457a8ea53642a43efec9950c8eeb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2634d60d3fbc322f122dacc07b9e00083342e7efbe03e17bf65457a826752cf4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5aba94a69f9e6f9f49f506393b4e1f94dcc8c733a154a04211a09d4ccf02889a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eab745772fec776a6f0c7c817900ac89dcc6e3a8917a2bfb414cfb44d3d67989\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d017fd2c0c444c2a18f9ee008dc7cca88e7d3772c4747e4627cd4d1578552705\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"866ba8602385aeaa90e8ae78ada1be9ce63dd09727bf4ecc6c1fa758e828a9bd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"764f95faac255d6894c3b72c3b5d4b3310629e20f3a61e4a24f480cdbb534ccf\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"15ff23dabc113f8de56339b254a90e582a84646a03e6621c05d53289f469023b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f7c94f5addf2a5fafe55d76d5abac3e9e255c9e513b938166b26072dbbe1ff7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"006181ea19644569eba45d273bd8a4fc3b9b2bd4ecbd3ef11fbb23f3a488daba\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a8f18c80abda1bd84eb4ce7401df1b9272f767e6067d1caddc8d7e5560b270c0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8a140385139e5d1094af15ad091323d3ab199555833d87f4aab24de3d072b6e1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f262fc03d8702fd881d8cd47fe5dc53fa2b0caa758bc5f53e1504d4228b89af8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9daf1c7213c63158612c39c6292118e88db3ad9946191083ee2a5a5a42090281\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2d3d2ed379ff94f056ee47d557617cf8e11ef5e053dc91ae59462c063d6bc659\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1e238b7d9e3f5d63d4bb1b2c1e20a3b8446c915d602f4a498ff5e32b26494ce9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"86e5206ca9dda35199b03c7404f14484a0dc9345dc56aa254257dad3fe3045c9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9d94bdb074cd59e0eeb52465f57a2886f3010a3084bca915240c377dfa69371d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"76aef54a15f29a2d7e6a2e90a2bca69a7f7006d2cc855729cfcbe5ed2e20bce6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f09d09fc6dde1d236524d4d6dcb928bdcf139e1b1ce84cce5a5a61d0dfbe9a0d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cbb1929d83c87332ce3ac1c2c7eb219492bfa2b8f14a75142746a20f7533efb3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8013b4888d8c0c89f4fb91ca2c345624f24083cc7b8ea83841c85560e17fd789\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"800ccb9059fb2669e3e7f64e2570052f23cc34e2c5c2df30ea9c882f6a6563a5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"848ef614bc7f06bf3e510719cdaccc63c032f4baa9511a3271180a15243597be\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7538aa8fb0f19ce73bd49b0cf2cc2529f3177a4e22fd00f296706e6193c57c62\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b7fd9eb41424bdbacdb2d2be398f7f3d33ee8577e46641724bb6c847f8a39b50\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8d5f23b63daf3626d0e9d0e10d1d1a2ffbe77f04a3e9ef732a89194f8231d888\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"81e7bc6ff15c5fcf552436509b25c7dfb574a74e08c2e48ee54b9755f92fa90a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"57d7aec31d434be52f7b457c9fb3411b8bed4ba7dd552ddb9a03f4f751b80ce9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"11d94353721e19c51aa0bc6aaf17a915f0c4bc5c5b03c6670c645da71e67b0ab\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c341acb6cdaf59c82cf61b20358dd3839468045103db5ec5c628531e6da465b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e43587797a9f0e99f41485cc6382657fd275bc0456caa79ddfb81c0a3829ce8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"792380c647e80d86421f854ef1b85a93875b66898601b71c4cf2a2e944e593c0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e9a145d980170d0288208e686227f27cf4330221d68aa965fa696259630442c4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9650a227b189b38fd3967a878a7dad544dfa7c3ff95cfcd0a2a874103408d1c7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05daa6d986fd5a49c2023f2b7516d814e699fceafa44c99344553fea00c14848\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6537b6fcd48e7484cc289a8663ad12d6efb1403bebedd27c74627597b05f748b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"19bfec94f9532ea4b5b1ff4e22e34dccda05f7858053828e2a904551707f45dc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea2123826bcdce0fdce2c5a90727e1dd179d03b031c83f0b813d0ae63eb69677\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b7432eac2809c3393fb8b46df502f39f77e27e5e88eff0e8835bfdb185fa9eef\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8950dc33891bcf7b11610edf1c476c4ad48308a70ee7a0715a4ecc0200f0750c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5e2828e21483a361ca7af9667f8d2d5b6b368fff80e00b61868847aed179c479\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e54452bb832f5639f81eea8108710ae6b8208c72f43891f5d68e3738c7045204\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"104f9b7f51a3df1f9430904dedb3f7a4cf21c6cc4c20557200b5472ed316a34b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9ba0e3c245ec075a8ac59e90542272767b57e107405871ea949b889ee6539e55\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d277167c1aa8cacaa4008b08884917c3bf967bff3e5581e0d555489ad3f97e24\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"36062c03d9e26d06762aa1187aebb222e71f039151b2c623f6b5367983de7d70\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"671fede733c21121c0fa91b5b6cadbeceb86fb48425b13fa2b5f9d78803a82f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"407d064e9fb88cdc3971fe2d6bf8c9b1420f29af1ffc535d11bb7ed27b64ff42\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"282fb13e85739e757462864ee696b3b5e995491369e9a8b047440bf7e1681190\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3b93464ed862579d468647c5a4c3b4bb20cd49b9fbc1508ab9a76bc02c103875\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d23d6b45289810b57bcf4421cc3f6d7a9b00af854de8d617d6f29562dd513117\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8f0952e906a65a8f638e31655c86ef2b14fcb462735baf16d752c564ec3685f0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2a63b0542f7d5e9ab21ff2a70e875d9016c654a34be4af8b2862093443d15c51\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f87733d531f5c5ac690831f7810e82ab2fa83c91261b4620c531b6c1e2597408\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"17173ba26c2e665c9e0e4ef6ffc67fd759e864382b5cbe50edc98a2bdae7ddd4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"26b154581e3881356d524a47c977002fcebf8fc95f12b0fe9e16ff9bc93b6869\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b444fff7c731702df9c43dd18a342ed5f4b84acbd2ae2c04e246e2ddadc11c94\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7dd0d1de5baa211489652a3c15f430b8d98c560c8a2d48d601fecea8ef647fe0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7cd969c2f8771fba44a7e483980f071aa82ff99f59db04390ca78ff143e778c0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1428a708edeea422ef4b9716589806d329bf8845f820bfe5bc7178813f441d85\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"076a038410428b9ac2bad029581c01b28cffd7b7f1a64c56465ca488c625b3c5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4c02356413d5b89c13f5a61a96468b87adeed2b50bd1a06310c89906490d0ef4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"50f9f35158468854257f3b1da534aee4a02c5f37c0b91fe1a72899c341660094\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7b9be35bff6fdec58573ed2c1a1152fcbea438cef2475fc4cc9c903209a01c16\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4917cb32e7b2094a58f1559c0d805212c1f0a354154ff0d6718a8463e5565d99\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5504d0ebc213428e8e60ba1b109351cf7131650f3094706e423b22777e0a6a2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c2d72b7f90bb96f33e2e1b00416be5fdbcedf88bc9b8577dd76935f6319a4e60\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"595ee786cd23b52cf9e2dc51a3ee8f43ca72d2ecc929144b3271d8f106843faa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce47c00ef51de8c42dff484190186d5315e9812635a34ef8cbec474b4571879a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a75be581b7a86b2a2c0f39b442e1fa507ea04ff01e418ef580566cfbccf215d7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5b7b766a72874acf9e8163ee483bc3d2370257bc288a07afd179471595fc5c6d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b205f794a68f488c4a8f87b688181870575e9b6ca3b2a00df6f22524886338aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce573b3027ad9607006464b4e16f49dcac328bda3098dc2f9cbf0de48aa9d1a3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1c971719638c32dc812964dd616c6226115934f0909c7b85ed98644b854b3cb5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ebf2ac513888626165cd2d0790db586c2e4365bfc263ad07ac289ad50a7f0ae7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"489c62d558d8722de6ee3dcfd2c48a08927d2cdbf9949a248345c4f615f73f62\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9a0f225cd047dcdb3f4867b212ef3e6dec20d7e8a4fca7af06293fb5c507b2a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"91af9bbd342d70e7ded90a99ca79e9232c49add440a0baa7506ff0f8fcb7b531\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4f9ad3ea2cb0afdd240e7a999cacd6f99c830a43e8d5ae688123da58c428bec2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96425c7ab5b8711bc556881ccc5c39b9c0666aa833805063b33ba887d4a5a819\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8c0cd107e1fa6f004c9af05b8c3102f19ebfd173ca67bf6c06fdd17256eaba05\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0d3bea7d8f4148509a7b4fdd379c391351993a4406d93efebab9d2e3a0fb2cb6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"054858abf03d49266e8b2b24aacaec6285f09f0adfa2239155a173261bdcca7c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3df8116a7d69f8b78dff00107df12558b13101576f05fa1c19384020dc817adf\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"13caff03101ec8fb67cc6985c5efbc26b786120381d2d76f2515fdb6fe7706e9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"62b30c6ad3a9fcfa5ee595e3c4ec2739df9ba145321ad1f24428f133ada2d563\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d698cb3490c21dc5d10c6de9a6bc389ce436a75532ce382d151ae459332e57ee\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f8ea478a97a900e8d13e31f88e44d56eb6952feee907f3e774a95b8e3de26382\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3ae6be995c08f6214b9af6f7ee2efd55d8f0b2fb8b2e04829e5955c670b7b74d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"264d2df2ea589600cf328e148b762248ac5130839cf3859470c36a43292ff4b1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w4-53dcb1"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w4-53dcb1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:09:45.966Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w1-7a590a","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T12:47:09Z","generation":39,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"59691ce6-45f9-466f-95b0-37ea51621f91\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T13:09:24Z"}],"name":"kuadrant-e2e-worker-w1-7a590a","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w1-7a590a","uid":"59691ce6-45f9-466f-95b0-37ea51621f91"}],"resourceVersion":"82462","uid":"bd8113b0-02c2-4ef6-ac7b-70f5da056591"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"089b88945c3f987cbd854645d335b1ed3f87d04e17e66f7e7d584e52c1c5293b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"782eb2b86655a7063ec50aeb50761ba028d5aff1c427b9c596182c02806eaa12\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2e367576ea8266051677e41fdcbf708227a0071dfb69638dc9f83fdd7d99ea86\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"abb38e7df8d6f08cddb11f57c793dd67cbfaa03e64e7203c1d0a6a9b4782282a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"393f2fdfebf241dcbaa0ae443b32e566084dad1b7c8cf4e6237de95a20ca10df\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"eccb2b7077041a6c5473fcb6f9dd58485e0f96567711421f1cea5cb80bfd0ccc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ab71c1c7c2dccd7c72591861016e3908312803953aee1a08f892ce78b33659fa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2458c735ddded8f7ebd5cdf1cfa73d33af85f1b4f5afa47ef1a360353df8c13e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a00bce455a8ba0c28f513d2cbb3426dff48ac572de4a180ceb56690724d00b35\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f93480a53e523b496c9412cfc58e7f75d121f2d651ea3172486dd7ddcc2ebf35\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4088f3063b27f9d26c95d8b4cc13218e60e59c7f63fece214340d3f0068f6909\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e8b2d8d9ec8f38b9b28942d9c36865b0222b1ca9d82d0f0809e2edc99917ff2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a736aff22b9f2c7af9549b13acf51819f8e99aa04b373d0fb5fbfff688b50cd2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"15900836e6f269b428a7ba51ef7d8dc0a7ca36c301a71f45a53f5f1c4a79ba0b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6cf8ff0bc2509d8cdb34100efac4ca00ad38423a4de09b25ae7f459379466a87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1a6fa01f3aa9c2d26611604900e9a0441bd093c5e19a824325c7f168cb47b11c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"36cb6cbb20273aad26612a19dd5f6c3efe2c9dd2c600f17ad0a915ef88d8b954\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"63b15ec160e5c3f65f606ccd476d6758762dc51865d27e9f2dc6d6ed47ec9551\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0ce7632c4354c0c227fddad698833ef251d10cefef7f25005691c0fadd7534b1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9e544a6ff3c5e4acbe799f06b93f4543c4988fff030e587768dfe9defb00adb0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3e115bb8bf2d55d71e7f9990370dc806ef02b0c5eb99439f32e357c379411367\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a065802be295503b7704c19b0b67b8359647e2add0f49d96146ed9826862d379\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a13d202396b9f03f9e7deb7b13b75b922053e1590d404210385aecaf73a5ca5f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cf188fd4e6d9497fe145323333d65c5de891abbe18df379b2c386769a6533c6f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d6490111a2bd671f3cc91af93da068c37ea6368b20512943eff2ebfeb9e7d117\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b7e6f5a5af1e174b1ee883237807902e5e8d83f39a3be55b585d44cdbecff572\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4ad3ddfc2a3be8b29229c40c95a4b848a9ba651d362feb03479f7b823e10f545\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"539d95d0b5c7e895aefe94233065bd18082830b3fea6a9277ca55a0da71340b3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8db81c68936ba298f790897b302b150bd12d2eec22154ddf944de0192d7f4b4c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c31eb0b4a50b2c61a2954216dce8a56e9cb3b868cf31d217e6d3d57c4b74fd9e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"09e967c8402e6e306f4b71e6a00f60bd434f2bce2c9d59dff1695d35697dc4dc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6aa87f2820fa15854a304fb36e50d7cee4820128539073fc15bb69753599e132\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3f89ae75a20ba19970a54ccc348cc608ebfca7566239d4f9b158f43febd42e55\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9eada5130b36b41e1e1266aa1092c165e97662a21634ed8ec0460d824bc7e7b9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ae63d00fa381b265866cb1b277633e2a155b94de180c6acefe93b77f7e35e7d3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bd16c47d55fdb5e0ae8240ed986c78707a88611b66b44fae5ab86cb758c215c2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e85025d98da554ebf7c487d2062eb7fa47a1b3d6adb7b480115a5ce4cefb0483\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"836df2ea33f6af85c72799cdb8019385010401c873eb9b12a0e6c749eeb56668\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8c4d0e21c666fd015a2db768ffb20bedac801efe539190c06ca7594e9010af8c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"41b85dccaa8cfcafa7d210e7cd2b1c31420b2b2efdf0b87f46a00d62669b0727\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c92a5de0eff7788429bc28fdec8d86609bf02b5fbedce82308479d1706288bec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0ddfa7441f1dbf1ef599148ed77f7bc3072873b1ec449858709aa517261dff6a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"55e675544ade227ac183e9688220aab677d3e3a4d82332e06ed1f425d673a304\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"573b340bccee4a5264ad13b0495d2a6b1e723bb0fe81a6ea97352001ebc74284\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a149d9912ccbb2cd4dd7e07e1172f90c639e64a98b99b9a1967bc3c9bf5d8205\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"609ddabc6778b868f1f0bc5795c071230a76ff3193b26ff5dfa7be54b1c5a36f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"068abb543fe2d8904c85c4227e66d1127808e1da52374db674dc113c87dc522c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdd84071c7d83946e35acff99c9c5b580e876d0c4866c006f5f02e0a107cdd19\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9ce8c2fa3380caeba39c62cfdb2e02b46776e4eac1f908f418140d9b7b883fe2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3586b85b746666dda45c0149c8b212ef8c2b5c5169e2f39c5d3154b119922636\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a5785a5c9d1c12ba13cd603c475c38ef808a12f3823a420b722dc3d70a23c624\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"929ffee0abc41c7a806ffd074e4cfab69d7dfd28eb926dc373bad2330b28a299\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b457a46f3c297a562935e2446d9043cdc1001219a34f31aa169362f32a741476\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ad0f8be0fcd3482ffc4dcce070db2233c156a97a5caf0ba8f88af3eb9789ca93\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"10edd1ae6c0df8a5a1b0594a6fb7b99897fa2d890c87aa6828ecbf4c438a7e03\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6406218469c6248feb077866776924189ca35825c99557888fce19ff8ad56df6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f0f1429576f1a1be321185e1bd6abb819aea50327fda0269d5612db65c382cfd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"75caeb2fecf39c98a65022db57b8b7402a53d8e3bbbbd1058c2a1344df78adfc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4c7e28c4ea66d3867db6e2053d338fd95c76975fa4ce24e65e7850a19b58e263\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"51885626998fd07a952d2366626fa9c9042a4fcef22103bb3076cdc7d2e1e952\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"96a10edf633153472e430c6c2106fabd9d088950913cb891f8d1131e8e85d5da\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ed976c06c4ca362c858910c3dccd54c51c7d22e06a10186b205bc19289bb4d8f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9fcc31bf477a6a539b09c1dafa0d8c389f6af32511fb4c214235577254b96a22\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"04b63ca6998dad8b1e7eed5109e0fa6e6afcad35fbb0aa65553b2ee5aa7c8240\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3a378a4162f02d06b635ffcd9cd97fb7c9975eac68f0d956efd8c3576a6c096c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"559d1da3a3af0f4a6de89f3ed2ff6387393bc8df7d2069266776fab4a9e58b5d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"82a9c25434b61c4772a1ac29246cbb75b1b553266861c57cdeeb5d939581bbaa\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"268824ed95ae571b569392c28a2f752ebe783a99f1990997fbf3d40d303b735b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"df21e7cfc8f3ee440a1487e95ff0c570ae804b786dd01a0d794bd1f3a9985389\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"78b3f9dfb7975e736779a46c7634f04113fea0c5fea7f904b45d4e20a637b245\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d15c406a43328781f512c3e6de986a018b3122ac39a7a4cbc136e998b2b48492\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"76f0f35cf466cedfbe1e34a2e63b4cdd3526f8da2eb57738bb657765040daf5b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e3eeda6dee0071c64c151bbb71350df5353b1c91473127cebe525b54a04ae2cc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"223d764a35e77651bb2257681287c29021eb09722bfc90c7265d02c5ba32cf5e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f41fcbb289a766d6a29268d2be644d886254d678311240795320efb90fdad5eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8395b1e94560ed62d84241a4f665ffff31837260cc9aea35c39d3c05175e3026\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b42d2ea2a5c62b1cba47bae62d396ed1c6451087f098340f79cc1ed15366e415\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"12ea3d26783f57b1d94da52ab6a5901ce98ed4b15dec468549f4012dafa05a23\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"daeca0bfe6a614d446a745f7a44cc67f378c849fbedaa1026e4914166e275650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7fb3347fe6c52798901732dc2685b483e2f0c905d248d89deecc83d92553d1c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1cc8f595efea76e0d3eedd32969d77ea8835ab68928410c6c8b033bf46f72923\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d980c3fc378b4f381adb615552ff0fc69397031c7df24757a73c4edf99162fc0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0adc57d51b35181d57ce7070149cb9dcb5a1c35659398baa1c2c66f130cf379f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a8939b3047ea77ce4de1421d66edd7fbcabaf6b680b0966fae12c9f2b8db7f47\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1ae748d971f49d47d371205b68e94c4d734abb4b723a86bcb07504627759dc89\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1736265c5ca3ff6ef8615dbb050d5afa5d5f07e06104e6e51bb14c17e58043e6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"23aab9fbc666b3e1b9b9e93c16a3f2a3603bc75c70d345208c83efb52c885c12\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"daebbb1a2f4340f3d13a56b86dc4092ce39c6919fdc16213b9251d005dc65bb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"30449cf39f411e1cc4fa580c9f841e231a5d83f9d8c88b5c2dab8b705d0f2b52\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2d5c153474ffbe61aefeb835638d7c68a30f6a8885318889cc87590a7f453a0a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1031e5fe412033da350814ac517fe44eb0eae32dbb531ffb2414912a07a0c15f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9c50fa0064a87ebd762cb4ac0b4dc0e17c2eea32530860448d0a09c94b7e47cf\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eceaa3373eca8aa1fa797e413753c17981f4395ea7c9e6478abf3dbb81e8216b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"741d1c871aa8bc86392a31b6ba5abccc2350355d6463723ec4a6627598f3ddf9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cdf3e72f09d9c23ed7de62e42d53e35a45b58ea6979b92283ba6e44040223a64\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c315208fda098a36b225a63347f5fd4c7ec4c6a07535d21d4963c136d75dda8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f1891bb22a9e5664f3026841b58d9ab6c8ff3d4c1597f502e3c8daf82fd67c78\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b3baf3122d7f4fb81c398e67dce1c007a39d77c1b944b2eb6d102ea948b9366e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2906b56422a5d1e18029f8dfe9f583868b1f6413dbb86a0e4489258e2491aee2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea79ff6eb5f370812a6f750d2a475542d4729e79ab7de6f1e3b51b10c9ff15f4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"53525895e62d7603774165b95492f86a299a94e811b8bfa096068557dc3b7079\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0aabe65457a62852cbc3f5efd4c9afd908cc365b81ff4ccff45d69457999be4f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8efe4c813ac88cde94cfd4bea026c778ccd1fc314df55d6fc5a83b02e37d153e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a5e8be6e6efa0995666cde2b04ee89d684553a2c184ce9d65be941363760f6aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a8c66d50ffdf82d6ecae69a1c0971f324d61cb035754e672c09e1374920c130f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3a98a433d7e13f7037d129fb607c0aa6be8e2786ab529798075891f1caa2e2a6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9aa33d1f7ee5b6f87dfab107560c9553ff008f5f640805b76152726175c3c7a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ef747846c68074cb6f3e6a721fe746c946c0fd87b764ad0f32c0db14a530760c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"105f27cff377e7455202b357006b2ff9c435dd06d077a77766a438b920e65ecb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6ea9e47cbae52d5f98c27737783d0dc37f05ed89537af90900d99ba724786368\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b53dd5318f075895d6819e8d4ceffc9d62fa37419025365efad5d4c37c032ae2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a4fbcc35d3dd061cbfe1038d04f72a085a63f22e6e41e51732d576dcf511ae51\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"774123679310f86a6cee928712e1340beda60d2cfd92fbbd2c0879a79005ee42\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c845c4a191326e7c9ecf6da0b052a10671217a1380a0016bca9315386f48ca03\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dde723c1559b7f93ce7e2cffbcf1cf349ad8c296646082c81a7499be56862cd1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9d8f49969e71ac351537bf21d0ed0bc0dc5eb1695291c30737b293be5df9682f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"22b1883b4b523fcb5aa2347e32fc0852b420c0da88d30eb8ccec885b0647939d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9dc5ba2a85da2966998ed0d77f55d9da2820d7f5d7306991557614037e39a0cc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3a4b1c0e3136e893a0ff6adebc7676449cb25c1230b5628462c88499dc931fae\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c7c1445e34f1134341c70b2411f384cfef83a00287915d9a085d8ab6d61f0f5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c2af1523299b2ae906db2cfc1bc1eca9f96ff5bcf739238555d11eab67499efe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bd6ed37fff73ea134b5c2e7eef124891ca252106484efbdc80756cc354e3ea56\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"750010eae93e29ff523a99ba4e5ef57554664f3213920e75c1959e2db0176128\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7aac3b22be2aee4090a6d0cb32dd002d0fad5a689857d4e92ee03a950b30e0c9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"74883f5b7e7a852327e008c7e9f03a1d91f98325beeb19c446f62796e6aef8d1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4d1ea02979cfe39c600e55838846c4eee4ddc92bb7fcfb3453cd070bcf3e2959\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"44fc74b91f49727f317f3fdebe4dddd5445c63c7601b59dbb817a847a2a1b2eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a982cae2c9190837d5ea04d6ba343f2ddc2a96065c397c50678676b3e6e6c245\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8bf7acafa93e755f68cfd59460e5a54df9f18ca04f2d003d86d0083de64598fe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6200b66035d445a0e4c1702bf2414c2e8877c2f2c473277de2bc9f6e9bf2fe8e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"035ae7b4aacac45527bf36277a7aad77aa4acceba99af38797fa4f951905ee54\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"34cdd18da494efc76065ea82ac3395638e9aca5c40abbd53c0f4538612f07d35\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w1-7a590a"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w1-7a590a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:09:45.986Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"b3c72654-a441-46eb-b600-8f86b5d68e10","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:09:46.002Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-53dcb1","namespace":"e2e-models-e2e-worker-w4-53dcb1","uid":"c38bfaf5-f2e6-48ca-82c3-93e2f72b5b36","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-53dcb1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:09:46.011Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-praxis-b-8f3cb8-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-praxis-b-8f3cb8-maas-auth\" not found"}
{"level":"error","ts":"2026-10-30T13:09:46.019Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny","namespace":"openshift-ingress","uid":"3ed0b548-54b3-4ca0-97cb-39f8824d0e4c","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:09:46.033Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-b-a81a48","namespace":"openshift-ingress","uid":"da70e898-3694-4670-90c3-d53aec414135","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-b-a81a48\" not found"}
{"level":"error","ts":"2026-10-30T13:09:46.049Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"f97bdc32-b5c0-44fe-b3e8-9f6d2bf611ce","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:09:46.066Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-53dcb1","namespace":"e2e-models-e2e-worker-w4-53dcb1","uid":"1092f88c-7f1b-4d74-9ba7-b9b0fd959b68","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-53dcb1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:09:46.081Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-7a590a","namespace":"e2e-models-e2e-worker-w1-7a590a","uid":"22506f20-f506-4553-8ba6-858d31792325","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-7a590a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:09:46.093Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ipp-b-a81a48-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-ipp-b-a81a48-maas-auth\" not found"}
{"level":"error","ts":"2026-10-30T13:09:46.097Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-7a590a","namespace":"e2e-models-e2e-worker-w1-7a590a","uid":"f9af62f3-67ad-4018-8e68-d1b98a22aebf","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-7a590a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:09:46.113Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-worker-w4-53dcb1","namespace":"openshift-ingress","uid":"52e3229d-606f-4db7-98bc-956f208ede10","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-worker-w4-53dcb1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:09:46.128Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-worker-w1-7a590a","namespace":"openshift-ingress","uid":"a56a2bd0-df27-43de-8bc2-258da0283d97","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-worker-w1-7a590a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:09:46.128Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-10-30T13:09:46.129Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-10-30T13:09:46.148Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-b-a81a48","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-b-a81a48\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:09:46.246Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-b-8f3cb8","error":"gateways.gateway.networking.k8s.io \"e2e-praxis-b-8f3cb8\" not found"}
{"level":"info","ts":"2026-10-30T13:09:46.266Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"IstioExtensionReconciler","operation":"update","resource":"openshift-ingress/kuadrant-e2e-worker-w1-7a590a","kind":"EnvoyFilter.networking.istio.io","error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w1-7a590a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:09:46.266Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"LimitadorLimitsReconciler","operation":"update","resource":"kuadrant-system/limitador","kind":"Limitador.limitador.kuadrant.io","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:09:46.266Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"IstioExtensionReconciler","operation":"update","resource":"openshift-ingress/kuadrant-e2e-ipp-b-a81a48","kind":"EnvoyFilter.networking.istio.io","error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-ipp-b-a81a48\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:09:46.266Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"IstioExtensionReconciler","operation":"update","resource":"openshift-ingress/kuadrant-e2e-worker-w4-53dcb1","kind":"EnvoyFilter.networking.istio.io","error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w4-53dcb1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:09:46.266Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"scheduling retry for non-blocking errors","errorCount":7,"requeueAfter":2}
{"level":"info","ts":"2026-10-30T13:09:48.267Z","logger":"kuadrant-operator.KuadrantController","msg":"triggering reconciliation retry for non-blocking errors","errorCount":7}
{"level":"info","ts":"2026-10-30T13:09:48.426Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Kuadrant","EnvoyFilter","TokenRateLimitPolicy","Limitador","Gateway","AuthConfig","HTTPRoute","AuthPolicy"],"eventTypes":{"delete":14,"update":16}}
{"level":"info","ts":"2026-10-30T13:09:48.467Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-10-30T13:09:48.478Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-10-30T13:09:48.975Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-10-30T13:09:48.985Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-10-30T13:09:49.112Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-10-30T13:09:49.112Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-10-30T13:09:49.193Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-10-30T13:09:50.014Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-10-30T13:09:50.070Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-10-30T13:09:50.076Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-10-30T13:09:50.083Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-10-30T13:09:50.083Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-10-30T13:09:50.091Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-10-30T13:09:50.097Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-10-30T13:09:51.501Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T12:42:13Z","generation":32,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"13037da2-7ce3-408f-991b-ad31db53d1ff\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:44:45Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"13037da2-7ce3-408f-991b-ad31db53d1ff"}],"resourceVersion":"18597","uid":"044e9012-9183-4278-aac0-7fa080f81471"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"etcdserver: request is too large"}
{"level":"error","ts":"2026-10-30T13:09:52.057Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-7a590a","namespace":"e2e-models-e2e-worker-w1-7a590a","uid":"f9af62f3-67ad-4018-8e68-d1b98a22aebf","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-7a590a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:09:52.078Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-10-30T13:09:52.078Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-10-30T13:09:52.244Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-b-a81a48","error":"gateways.gateway.networking.k8s.io \"e2e-ipp-b-a81a48\" not found"}
{"level":"info","ts":"2026-10-30T13:09:52.293Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthPolicy.kuadrant.io/openshift-ingress/e2e-ipp-b-a81a48-maas-auth/update","attempts":2,"duration":10.602647489}
{"level":"info","ts":"2026-10-30T13:09:52.293Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"EnvoyFilter.networking.istio.io/openshift-ingress/kuadrant-e2e-worker-w4-53dcb1/update","attempts":1,"duration":6.02755831}
{"level":"info","ts":"2026-10-30T13:09:52.293Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"EnvoyFilter.networking.istio.io/openshift-ingress/kuadrant-e2e-ipp-b-a81a48/update","attempts":1,"duration":6.027572725}
{"level":"info","ts":"2026-10-30T13:09:52.293Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"EnvoyFilter.networking.istio.io/openshift-ingress/kuadrant-e2e-worker-w1-7a590a/update","attempts":1,"duration":6.027638076}
{"level":"info","ts":"2026-10-30T13:09:52.293Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"Limitador.limitador.kuadrant.io/kuadrant-system/limitador/update","attempts":1,"duration":6.027596291}
{"level":"info","ts":"2026-10-30T13:09:52.293Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthPolicy.kuadrant.io/openshift-ingress/e2e-praxis-b-8f3cb8-maas-auth/update","attempts":2,"duration":10.60279473}
{"level":"info","ts":"2026-10-30T13:09:52.293Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"scheduling retry for non-blocking errors","errorCount":1,"requeueAfter":16}
{"level":"info","ts":"2026-10-30T13:09:55.129Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","EnvoyFilter","ConfigMap","Limitador","AuthConfig","Gateway"],"eventTypes":{"delete":10,"update":6}}
{"level":"info","ts":"2026-10-30T13:09:55.179Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-10-30T13:09:55.190Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-10-30T13:09:55.872Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-10-30T13:09:55.897Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-10-30T13:09:55.909Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-10-30T13:09:55.909Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-10-30T13:09:56.577Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-10-30T13:09:56.582Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-10-30T13:09:56.582Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-10-30T13:09:56.582Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-10-30T13:09:56.591Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-10-30T13:09:56.577Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-10-30T13:09:56.605Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-10-30T13:09:58.814Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T12:42:13Z","generation":32,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"13037da2-7ce3-408f-991b-ad31db53d1ff\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:44:45Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"13037da2-7ce3-408f-991b-ad31db53d1ff"}],"resourceVersion":"18597","uid":"044e9012-9183-4278-aac0-7fa080f81471"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"etcdserver: request is too large"}
{"level":"info","ts":"2026-10-30T13:09:59.047Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-10-30T13:09:59.047Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-10-30T13:09:59.220Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"scheduling retry for non-blocking errors","errorCount":1,"requeueAfter":32}
{"level":"info","ts":"2026-10-30T13:10:03.514Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","Gateway","Kuadrant","ConfigMap","TokenRateLimitPolicy","HTTPRoute"],"eventTypes":{"delete":3,"update":7}}
{"level":"info","ts":"2026-10-30T13:10:03.618Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-10-30T13:10:03.670Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-10-30T13:10:04.178Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-10-30T13:10:04.219Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-10-30T13:10:04.295Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-10-30T13:10:04.371Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-10-30T13:10:04.371Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-10-30T13:10:05.005Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-10-30T13:10:05.007Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-10-30T13:10:05.007Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-10-30T13:10:05.018Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-10-30T13:10:05.021Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-10-30T13:10:05.070Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-10-30T13:10:05.073Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-10-30T13:10:05.887Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T12:42:13Z","generation":32,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"13037da2-7ce3-408f-991b-ad31db53d1ff\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:44:45Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"13037da2-7ce3-408f-991b-ad31db53d1ff"}],"resourceVersion":"18597","uid":"044e9012-9183-4278-aac0-7fa080f81471"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"etcdserver: request is too large"}
{"level":"info","ts":"2026-10-30T13:10:07.005Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-10-30T13:10:07.005Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-10-30T13:10:07.192Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"max retry attempts reached, giving up","source":"IstioExtensionReconciler","operation":"update","resource":"openshift-ingress/kuadrant-maas-default-gateway","kind":"EnvoyFilter.networking.istio.io","attempts":5,"duration":31.862143672,"error":"etcdserver: request is too large"}
{"level":"info","ts":"2026-10-30T13:10:07.193Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"all non-blocking errors have exceeded max retry attempts","errorCount":0}
{"level":"info","ts":"2026-10-30T13:10:07.317Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","EnvoyFilter","Gateway","ConfigMap","HTTPRoute"],"eventTypes":{"delete":3,"update":17}}
{"level":"info","ts":"2026-10-30T13:10:07.354Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-10-30T13:10:08.177Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-10-30T13:10:09.623Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-10-30T13:10:09.638Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-10-30T13:10:09.651Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-10-30T13:10:09.667Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-10-30T13:10:09.667Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-10-30T13:10:09.676Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-10-30T13:10:09.691Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:09.691Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-10-30T13:10:10.313Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w4-53dcb1","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T12:46:57Z","generation":46,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"ad19e696-52ed-4450-94f1-eded048bba27\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T13:09:57Z"}],"name":"kuadrant-e2e-worker-w4-53dcb1","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w4-53dcb1","uid":"ad19e696-52ed-4450-94f1-eded048bba27"}],"resourceVersion":"83498","uid":"9ec80002-b898-42ba-8857-784b6380ab66"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"25a1c9993b6f4ea69206eb6b230a0d5e752e689ebff241573f64cb0dcfed87bb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fdd2e931d0bc13263b903b61e1e009643cb3cb9f04728983f0a3ad1f80b17c2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05721040781acc43415365dffa14dcbb8008a73032f9fb4236838ae804f27cd9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7bc4fa4dc4148ac1b4dafbf544ddd9d141620d3c180513f76d642f7f7ec70af7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c5f2c0c7936757ece0bd2bc5d5d0172ca7760238d4a1aa4770798563e686071e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"08e10bd762ef9d277835f71d88a02ff17d9288d457fbc20c34f4c0fa61ace29e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0d0c5ad4cf5daf3340df7ec7bc02c0227878b43cc86f681eb8dceb836c188bac\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"77d288314f0282382ba31d8fff80ddccb1ca29df3066d00f7a2d9fc7cf6b06aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29ab17092352c0529d55cf050576da245a70dd62cec1da7912970150bd59a079\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbe36e82df47f6018446263f2720506e0888dad51ebdbd8a452aa39bab62320a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"de83e7795994116b47a6afcb4c300d56e6212f572909b311eebdae742b22db18\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2fa69e45d07440b1d4349b9a6603a14ca661a5cea439561e12cad2ab34bc3787\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c00658935c443bfc6b50aacecd40e2757e1434283a8ff1433611aebc4bfff347\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"99af2676f76182c413086a97bb31d9c67c509d7197fccbb26a9f72924cb9b153\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"865fe8edccec04f5fb55cdfef525c52c270ff0e4a7669ebd90714b892bc6b5ab\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4929a20f544b7005ce186874f90904640440dbf6bcf27f631412f6d0aaf65ee7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b1dfa4f975f7d58a22d462c662503f31664b7344d77150fc12167f31f05ca0a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"dba194f3dbcac655aebddfa3ea98dd2dd486760005d2ff2e87db3b2b445dd235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5905c63b7a6f8479c2bdf582769cf959048fe65bc9d0292d78dff259df383f54\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ac0b09d88152f12160535805c80002cbfb09c9925933ae43bd5d449357ff396a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"39d0af230c6555e4d3c2ee1dc247c36f417b1cc3502e3bed0a588e095410987f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ffef4b578a566be9626a99782a91b7ef0bea204cabe0bc69c5acd09f6c3673d7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a69418c064056026973af3a090f779fbb3dc3ee106c8054a7822cb4bdba759fb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6da0786f468dfd552ade1b11b8c3bfa854fff0f80cdd4b34fd451d8c50f0cf6d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6c547c2167c9135ebd65453f030b83b6bbbbb0e12fc95c7efa6b55331a01a81c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"520b3c828dbcc36acab6d0c5c97168f2df746cea294b070c48a25e4e9c26b26d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"84fcdcffb035aa4df026ea8b182c1d985c4deb171fb09264f5c2b78a7e290054\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"145d954305506b9fba35d76b2657c538b39d74dbeb078381aea86745b7bd64a7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"663790a0510f2693daf89340f00b57d9cb74a7e630de51e1f4e40f5759072963\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c9af5d5096c5c8e060feb79ccbf8348d2d5d819edf39a5dbafd4bd61c28de2b4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7e2454df0aada7fdd8ccd57fac150f260861e6c3472d5bdceeba2460b533958a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2b6f42efd682e1ea0376780340d0f60cef20eabdc177badf8c8ad46bf67daa6f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4c43f9d5f89223314ff24852e7f60990cdcffd391cae2e1728b63cb0cbd8e575\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b09bb280a4a5caa95494a0190d901dcb323926a950e611ffe112fe41c2586a6b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"46fc87d721087034978051b991603b15a1549a42ffd6a9f2d7540fa624d9fbe0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"07a9fbfd845551af5d7e8ad023ca8fb4bca991962b48191e7b9e7ec9f7c9410a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06644eed28a6354f9d9cbd205635366137e6f9a985e0cdf1f830923dc4c32196\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"68ecb87a9879d271a0377e0c71e8bb13fb86e8b9efb884649b22354c53bc0f98\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6ce786297e806878f759f8ebe30957c2bd515f34c8cd580c47396d68b73ee3d1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4806fdc003ab234e5613ac5978afcbb90ad7ee95e124d8b8b68bd3ae14a6a4dd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6ef9659353658fa30f8a50bb13e2e8523254919072f9604a5929a5ceb0a6bc17\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bab2aab3d0a190fbfe76a15bd83bb4d25567457a8ea53642a43efec9950c8eeb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2634d60d3fbc322f122dacc07b9e00083342e7efbe03e17bf65457a826752cf4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5aba94a69f9e6f9f49f506393b4e1f94dcc8c733a154a04211a09d4ccf02889a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eab745772fec776a6f0c7c817900ac89dcc6e3a8917a2bfb414cfb44d3d67989\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d017fd2c0c444c2a18f9ee008dc7cca88e7d3772c4747e4627cd4d1578552705\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"866ba8602385aeaa90e8ae78ada1be9ce63dd09727bf4ecc6c1fa758e828a9bd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"764f95faac255d6894c3b72c3b5d4b3310629e20f3a61e4a24f480cdbb534ccf\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"15ff23dabc113f8de56339b254a90e582a84646a03e6621c05d53289f469023b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f7c94f5addf2a5fafe55d76d5abac3e9e255c9e513b938166b26072dbbe1ff7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"006181ea19644569eba45d273bd8a4fc3b9b2bd4ecbd3ef11fbb23f3a488daba\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a8f18c80abda1bd84eb4ce7401df1b9272f767e6067d1caddc8d7e5560b270c0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8a140385139e5d1094af15ad091323d3ab199555833d87f4aab24de3d072b6e1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f262fc03d8702fd881d8cd47fe5dc53fa2b0caa758bc5f53e1504d4228b89af8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9daf1c7213c63158612c39c6292118e88db3ad9946191083ee2a5a5a42090281\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2d3d2ed379ff94f056ee47d557617cf8e11ef5e053dc91ae59462c063d6bc659\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1e238b7d9e3f5d63d4bb1b2c1e20a3b8446c915d602f4a498ff5e32b26494ce9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"86e5206ca9dda35199b03c7404f14484a0dc9345dc56aa254257dad3fe3045c9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9d94bdb074cd59e0eeb52465f57a2886f3010a3084bca915240c377dfa69371d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"76aef54a15f29a2d7e6a2e90a2bca69a7f7006d2cc855729cfcbe5ed2e20bce6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f09d09fc6dde1d236524d4d6dcb928bdcf139e1b1ce84cce5a5a61d0dfbe9a0d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cbb1929d83c87332ce3ac1c2c7eb219492bfa2b8f14a75142746a20f7533efb3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8013b4888d8c0c89f4fb91ca2c345624f24083cc7b8ea83841c85560e17fd789\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"800ccb9059fb2669e3e7f64e2570052f23cc34e2c5c2df30ea9c882f6a6563a5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"848ef614bc7f06bf3e510719cdaccc63c032f4baa9511a3271180a15243597be\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7538aa8fb0f19ce73bd49b0cf2cc2529f3177a4e22fd00f296706e6193c57c62\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b7fd9eb41424bdbacdb2d2be398f7f3d33ee8577e46641724bb6c847f8a39b50\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8d5f23b63daf3626d0e9d0e10d1d1a2ffbe77f04a3e9ef732a89194f8231d888\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"81e7bc6ff15c5fcf552436509b25c7dfb574a74e08c2e48ee54b9755f92fa90a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"57d7aec31d434be52f7b457c9fb3411b8bed4ba7dd552ddb9a03f4f751b80ce9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"11d94353721e19c51aa0bc6aaf17a915f0c4bc5c5b03c6670c645da71e67b0ab\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c341acb6cdaf59c82cf61b20358dd3839468045103db5ec5c628531e6da465b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e43587797a9f0e99f41485cc6382657fd275bc0456caa79ddfb81c0a3829ce8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"792380c647e80d86421f854ef1b85a93875b66898601b71c4cf2a2e944e593c0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e9a145d980170d0288208e686227f27cf4330221d68aa965fa696259630442c4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9650a227b189b38fd3967a878a7dad544dfa7c3ff95cfcd0a2a874103408d1c7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05daa6d986fd5a49c2023f2b7516d814e699fceafa44c99344553fea00c14848\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6537b6fcd48e7484cc289a8663ad12d6efb1403bebedd27c74627597b05f748b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"19bfec94f9532ea4b5b1ff4e22e34dccda05f7858053828e2a904551707f45dc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea2123826bcdce0fdce2c5a90727e1dd179d03b031c83f0b813d0ae63eb69677\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b7432eac2809c3393fb8b46df502f39f77e27e5e88eff0e8835bfdb185fa9eef\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8950dc33891bcf7b11610edf1c476c4ad48308a70ee7a0715a4ecc0200f0750c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5e2828e21483a361ca7af9667f8d2d5b6b368fff80e00b61868847aed179c479\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e54452bb832f5639f81eea8108710ae6b8208c72f43891f5d68e3738c7045204\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"104f9b7f51a3df1f9430904dedb3f7a4cf21c6cc4c20557200b5472ed316a34b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9ba0e3c245ec075a8ac59e90542272767b57e107405871ea949b889ee6539e55\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d277167c1aa8cacaa4008b08884917c3bf967bff3e5581e0d555489ad3f97e24\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"36062c03d9e26d06762aa1187aebb222e71f039151b2c623f6b5367983de7d70\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"671fede733c21121c0fa91b5b6cadbeceb86fb48425b13fa2b5f9d78803a82f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"407d064e9fb88cdc3971fe2d6bf8c9b1420f29af1ffc535d11bb7ed27b64ff42\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"282fb13e85739e757462864ee696b3b5e995491369e9a8b047440bf7e1681190\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3b93464ed862579d468647c5a4c3b4bb20cd49b9fbc1508ab9a76bc02c103875\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d23d6b45289810b57bcf4421cc3f6d7a9b00af854de8d617d6f29562dd513117\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8f0952e906a65a8f638e31655c86ef2b14fcb462735baf16d752c564ec3685f0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2a63b0542f7d5e9ab21ff2a70e875d9016c654a34be4af8b2862093443d15c51\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f87733d531f5c5ac690831f7810e82ab2fa83c91261b4620c531b6c1e2597408\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"17173ba26c2e665c9e0e4ef6ffc67fd759e864382b5cbe50edc98a2bdae7ddd4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"26b154581e3881356d524a47c977002fcebf8fc95f12b0fe9e16ff9bc93b6869\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b444fff7c731702df9c43dd18a342ed5f4b84acbd2ae2c04e246e2ddadc11c94\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7dd0d1de5baa211489652a3c15f430b8d98c560c8a2d48d601fecea8ef647fe0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7cd969c2f8771fba44a7e483980f071aa82ff99f59db04390ca78ff143e778c0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1428a708edeea422ef4b9716589806d329bf8845f820bfe5bc7178813f441d85\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"076a038410428b9ac2bad029581c01b28cffd7b7f1a64c56465ca488c625b3c5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4c02356413d5b89c13f5a61a96468b87adeed2b50bd1a06310c89906490d0ef4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"50f9f35158468854257f3b1da534aee4a02c5f37c0b91fe1a72899c341660094\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7b9be35bff6fdec58573ed2c1a1152fcbea438cef2475fc4cc9c903209a01c16\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4917cb32e7b2094a58f1559c0d805212c1f0a354154ff0d6718a8463e5565d99\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5504d0ebc213428e8e60ba1b109351cf7131650f3094706e423b22777e0a6a2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c2d72b7f90bb96f33e2e1b00416be5fdbcedf88bc9b8577dd76935f6319a4e60\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"595ee786cd23b52cf9e2dc51a3ee8f43ca72d2ecc929144b3271d8f106843faa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce47c00ef51de8c42dff484190186d5315e9812635a34ef8cbec474b4571879a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a75be581b7a86b2a2c0f39b442e1fa507ea04ff01e418ef580566cfbccf215d7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5b7b766a72874acf9e8163ee483bc3d2370257bc288a07afd179471595fc5c6d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b205f794a68f488c4a8f87b688181870575e9b6ca3b2a00df6f22524886338aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce573b3027ad9607006464b4e16f49dcac328bda3098dc2f9cbf0de48aa9d1a3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1c971719638c32dc812964dd616c6226115934f0909c7b85ed98644b854b3cb5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ebf2ac513888626165cd2d0790db586c2e4365bfc263ad07ac289ad50a7f0ae7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"489c62d558d8722de6ee3dcfd2c48a08927d2cdbf9949a248345c4f615f73f62\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9a0f225cd047dcdb3f4867b212ef3e6dec20d7e8a4fca7af06293fb5c507b2a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"91af9bbd342d70e7ded90a99ca79e9232c49add440a0baa7506ff0f8fcb7b531\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4f9ad3ea2cb0afdd240e7a999cacd6f99c830a43e8d5ae688123da58c428bec2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96425c7ab5b8711bc556881ccc5c39b9c0666aa833805063b33ba887d4a5a819\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8c0cd107e1fa6f004c9af05b8c3102f19ebfd173ca67bf6c06fdd17256eaba05\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0d3bea7d8f4148509a7b4fdd379c391351993a4406d93efebab9d2e3a0fb2cb6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"054858abf03d49266e8b2b24aacaec6285f09f0adfa2239155a173261bdcca7c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3df8116a7d69f8b78dff00107df12558b13101576f05fa1c19384020dc817adf\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"13caff03101ec8fb67cc6985c5efbc26b786120381d2d76f2515fdb6fe7706e9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"62b30c6ad3a9fcfa5ee595e3c4ec2739df9ba145321ad1f24428f133ada2d563\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d698cb3490c21dc5d10c6de9a6bc389ce436a75532ce382d151ae459332e57ee\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f8ea478a97a900e8d13e31f88e44d56eb6952feee907f3e774a95b8e3de26382\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3ae6be995c08f6214b9af6f7ee2efd55d8f0b2fb8b2e04829e5955c670b7b74d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"264d2df2ea589600cf328e148b762248ac5130839cf3859470c36a43292ff4b1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w4-53dcb1"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w4-53dcb1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:10.561Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w1-7a590a","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T12:47:09Z","generation":42,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"59691ce6-45f9-466f-95b0-37ea51621f91\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T13:09:57Z"}],"name":"kuadrant-e2e-worker-w1-7a590a","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w1-7a590a","uid":"59691ce6-45f9-466f-95b0-37ea51621f91"}],"resourceVersion":"83510","uid":"bd8113b0-02c2-4ef6-ac7b-70f5da056591"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"089b88945c3f987cbd854645d335b1ed3f87d04e17e66f7e7d584e52c1c5293b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"782eb2b86655a7063ec50aeb50761ba028d5aff1c427b9c596182c02806eaa12\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2e367576ea8266051677e41fdcbf708227a0071dfb69638dc9f83fdd7d99ea86\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"abb38e7df8d6f08cddb11f57c793dd67cbfaa03e64e7203c1d0a6a9b4782282a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"393f2fdfebf241dcbaa0ae443b32e566084dad1b7c8cf4e6237de95a20ca10df\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"eccb2b7077041a6c5473fcb6f9dd58485e0f96567711421f1cea5cb80bfd0ccc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ab71c1c7c2dccd7c72591861016e3908312803953aee1a08f892ce78b33659fa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2458c735ddded8f7ebd5cdf1cfa73d33af85f1b4f5afa47ef1a360353df8c13e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a00bce455a8ba0c28f513d2cbb3426dff48ac572de4a180ceb56690724d00b35\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f93480a53e523b496c9412cfc58e7f75d121f2d651ea3172486dd7ddcc2ebf35\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4088f3063b27f9d26c95d8b4cc13218e60e59c7f63fece214340d3f0068f6909\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e8b2d8d9ec8f38b9b28942d9c36865b0222b1ca9d82d0f0809e2edc99917ff2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a736aff22b9f2c7af9549b13acf51819f8e99aa04b373d0fb5fbfff688b50cd2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"15900836e6f269b428a7ba51ef7d8dc0a7ca36c301a71f45a53f5f1c4a79ba0b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6cf8ff0bc2509d8cdb34100efac4ca00ad38423a4de09b25ae7f459379466a87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1a6fa01f3aa9c2d26611604900e9a0441bd093c5e19a824325c7f168cb47b11c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"36cb6cbb20273aad26612a19dd5f6c3efe2c9dd2c600f17ad0a915ef88d8b954\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"63b15ec160e5c3f65f606ccd476d6758762dc51865d27e9f2dc6d6ed47ec9551\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0ce7632c4354c0c227fddad698833ef251d10cefef7f25005691c0fadd7534b1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9e544a6ff3c5e4acbe799f06b93f4543c4988fff030e587768dfe9defb00adb0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3e115bb8bf2d55d71e7f9990370dc806ef02b0c5eb99439f32e357c379411367\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a065802be295503b7704c19b0b67b8359647e2add0f49d96146ed9826862d379\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a13d202396b9f03f9e7deb7b13b75b922053e1590d404210385aecaf73a5ca5f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cf188fd4e6d9497fe145323333d65c5de891abbe18df379b2c386769a6533c6f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d6490111a2bd671f3cc91af93da068c37ea6368b20512943eff2ebfeb9e7d117\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b7e6f5a5af1e174b1ee883237807902e5e8d83f39a3be55b585d44cdbecff572\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4ad3ddfc2a3be8b29229c40c95a4b848a9ba651d362feb03479f7b823e10f545\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"539d95d0b5c7e895aefe94233065bd18082830b3fea6a9277ca55a0da71340b3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8db81c68936ba298f790897b302b150bd12d2eec22154ddf944de0192d7f4b4c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c31eb0b4a50b2c61a2954216dce8a56e9cb3b868cf31d217e6d3d57c4b74fd9e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"09e967c8402e6e306f4b71e6a00f60bd434f2bce2c9d59dff1695d35697dc4dc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6aa87f2820fa15854a304fb36e50d7cee4820128539073fc15bb69753599e132\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3f89ae75a20ba19970a54ccc348cc608ebfca7566239d4f9b158f43febd42e55\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9eada5130b36b41e1e1266aa1092c165e97662a21634ed8ec0460d824bc7e7b9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ae63d00fa381b265866cb1b277633e2a155b94de180c6acefe93b77f7e35e7d3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bd16c47d55fdb5e0ae8240ed986c78707a88611b66b44fae5ab86cb758c215c2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e85025d98da554ebf7c487d2062eb7fa47a1b3d6adb7b480115a5ce4cefb0483\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"836df2ea33f6af85c72799cdb8019385010401c873eb9b12a0e6c749eeb56668\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8c4d0e21c666fd015a2db768ffb20bedac801efe539190c06ca7594e9010af8c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"41b85dccaa8cfcafa7d210e7cd2b1c31420b2b2efdf0b87f46a00d62669b0727\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c92a5de0eff7788429bc28fdec8d86609bf02b5fbedce82308479d1706288bec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0ddfa7441f1dbf1ef599148ed77f7bc3072873b1ec449858709aa517261dff6a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"55e675544ade227ac183e9688220aab677d3e3a4d82332e06ed1f425d673a304\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"573b340bccee4a5264ad13b0495d2a6b1e723bb0fe81a6ea97352001ebc74284\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a149d9912ccbb2cd4dd7e07e1172f90c639e64a98b99b9a1967bc3c9bf5d8205\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"609ddabc6778b868f1f0bc5795c071230a76ff3193b26ff5dfa7be54b1c5a36f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"068abb543fe2d8904c85c4227e66d1127808e1da52374db674dc113c87dc522c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdd84071c7d83946e35acff99c9c5b580e876d0c4866c006f5f02e0a107cdd19\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9ce8c2fa3380caeba39c62cfdb2e02b46776e4eac1f908f418140d9b7b883fe2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3586b85b746666dda45c0149c8b212ef8c2b5c5169e2f39c5d3154b119922636\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a5785a5c9d1c12ba13cd603c475c38ef808a12f3823a420b722dc3d70a23c624\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"929ffee0abc41c7a806ffd074e4cfab69d7dfd28eb926dc373bad2330b28a299\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b457a46f3c297a562935e2446d9043cdc1001219a34f31aa169362f32a741476\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ad0f8be0fcd3482ffc4dcce070db2233c156a97a5caf0ba8f88af3eb9789ca93\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"10edd1ae6c0df8a5a1b0594a6fb7b99897fa2d890c87aa6828ecbf4c438a7e03\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6406218469c6248feb077866776924189ca35825c99557888fce19ff8ad56df6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f0f1429576f1a1be321185e1bd6abb819aea50327fda0269d5612db65c382cfd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"75caeb2fecf39c98a65022db57b8b7402a53d8e3bbbbd1058c2a1344df78adfc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4c7e28c4ea66d3867db6e2053d338fd95c76975fa4ce24e65e7850a19b58e263\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"51885626998fd07a952d2366626fa9c9042a4fcef22103bb3076cdc7d2e1e952\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"96a10edf633153472e430c6c2106fabd9d088950913cb891f8d1131e8e85d5da\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ed976c06c4ca362c858910c3dccd54c51c7d22e06a10186b205bc19289bb4d8f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9fcc31bf477a6a539b09c1dafa0d8c389f6af32511fb4c214235577254b96a22\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"04b63ca6998dad8b1e7eed5109e0fa6e6afcad35fbb0aa65553b2ee5aa7c8240\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3a378a4162f02d06b635ffcd9cd97fb7c9975eac68f0d956efd8c3576a6c096c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"559d1da3a3af0f4a6de89f3ed2ff6387393bc8df7d2069266776fab4a9e58b5d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"82a9c25434b61c4772a1ac29246cbb75b1b553266861c57cdeeb5d939581bbaa\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"268824ed95ae571b569392c28a2f752ebe783a99f1990997fbf3d40d303b735b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"df21e7cfc8f3ee440a1487e95ff0c570ae804b786dd01a0d794bd1f3a9985389\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"78b3f9dfb7975e736779a46c7634f04113fea0c5fea7f904b45d4e20a637b245\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d15c406a43328781f512c3e6de986a018b3122ac39a7a4cbc136e998b2b48492\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"76f0f35cf466cedfbe1e34a2e63b4cdd3526f8da2eb57738bb657765040daf5b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e3eeda6dee0071c64c151bbb71350df5353b1c91473127cebe525b54a04ae2cc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"223d764a35e77651bb2257681287c29021eb09722bfc90c7265d02c5ba32cf5e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f41fcbb289a766d6a29268d2be644d886254d678311240795320efb90fdad5eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8395b1e94560ed62d84241a4f665ffff31837260cc9aea35c39d3c05175e3026\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b42d2ea2a5c62b1cba47bae62d396ed1c6451087f098340f79cc1ed15366e415\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"12ea3d26783f57b1d94da52ab6a5901ce98ed4b15dec468549f4012dafa05a23\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"daeca0bfe6a614d446a745f7a44cc67f378c849fbedaa1026e4914166e275650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7fb3347fe6c52798901732dc2685b483e2f0c905d248d89deecc83d92553d1c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1cc8f595efea76e0d3eedd32969d77ea8835ab68928410c6c8b033bf46f72923\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d980c3fc378b4f381adb615552ff0fc69397031c7df24757a73c4edf99162fc0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0adc57d51b35181d57ce7070149cb9dcb5a1c35659398baa1c2c66f130cf379f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a8939b3047ea77ce4de1421d66edd7fbcabaf6b680b0966fae12c9f2b8db7f47\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1ae748d971f49d47d371205b68e94c4d734abb4b723a86bcb07504627759dc89\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1736265c5ca3ff6ef8615dbb050d5afa5d5f07e06104e6e51bb14c17e58043e6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"23aab9fbc666b3e1b9b9e93c16a3f2a3603bc75c70d345208c83efb52c885c12\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"daebbb1a2f4340f3d13a56b86dc4092ce39c6919fdc16213b9251d005dc65bb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"30449cf39f411e1cc4fa580c9f841e231a5d83f9d8c88b5c2dab8b705d0f2b52\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2d5c153474ffbe61aefeb835638d7c68a30f6a8885318889cc87590a7f453a0a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1031e5fe412033da350814ac517fe44eb0eae32dbb531ffb2414912a07a0c15f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9c50fa0064a87ebd762cb4ac0b4dc0e17c2eea32530860448d0a09c94b7e47cf\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eceaa3373eca8aa1fa797e413753c17981f4395ea7c9e6478abf3dbb81e8216b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"741d1c871aa8bc86392a31b6ba5abccc2350355d6463723ec4a6627598f3ddf9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cdf3e72f09d9c23ed7de62e42d53e35a45b58ea6979b92283ba6e44040223a64\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c315208fda098a36b225a63347f5fd4c7ec4c6a07535d21d4963c136d75dda8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f1891bb22a9e5664f3026841b58d9ab6c8ff3d4c1597f502e3c8daf82fd67c78\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b3baf3122d7f4fb81c398e67dce1c007a39d77c1b944b2eb6d102ea948b9366e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2906b56422a5d1e18029f8dfe9f583868b1f6413dbb86a0e4489258e2491aee2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea79ff6eb5f370812a6f750d2a475542d4729e79ab7de6f1e3b51b10c9ff15f4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"53525895e62d7603774165b95492f86a299a94e811b8bfa096068557dc3b7079\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0aabe65457a62852cbc3f5efd4c9afd908cc365b81ff4ccff45d69457999be4f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8efe4c813ac88cde94cfd4bea026c778ccd1fc314df55d6fc5a83b02e37d153e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a5e8be6e6efa0995666cde2b04ee89d684553a2c184ce9d65be941363760f6aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a8c66d50ffdf82d6ecae69a1c0971f324d61cb035754e672c09e1374920c130f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3a98a433d7e13f7037d129fb607c0aa6be8e2786ab529798075891f1caa2e2a6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9aa33d1f7ee5b6f87dfab107560c9553ff008f5f640805b76152726175c3c7a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ef747846c68074cb6f3e6a721fe746c946c0fd87b764ad0f32c0db14a530760c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"105f27cff377e7455202b357006b2ff9c435dd06d077a77766a438b920e65ecb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6ea9e47cbae52d5f98c27737783d0dc37f05ed89537af90900d99ba724786368\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b53dd5318f075895d6819e8d4ceffc9d62fa37419025365efad5d4c37c032ae2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a4fbcc35d3dd061cbfe1038d04f72a085a63f22e6e41e51732d576dcf511ae51\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"774123679310f86a6cee928712e1340beda60d2cfd92fbbd2c0879a79005ee42\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c845c4a191326e7c9ecf6da0b052a10671217a1380a0016bca9315386f48ca03\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dde723c1559b7f93ce7e2cffbcf1cf349ad8c296646082c81a7499be56862cd1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9d8f49969e71ac351537bf21d0ed0bc0dc5eb1695291c30737b293be5df9682f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"22b1883b4b523fcb5aa2347e32fc0852b420c0da88d30eb8ccec885b0647939d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9dc5ba2a85da2966998ed0d77f55d9da2820d7f5d7306991557614037e39a0cc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3a4b1c0e3136e893a0ff6adebc7676449cb25c1230b5628462c88499dc931fae\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c7c1445e34f1134341c70b2411f384cfef83a00287915d9a085d8ab6d61f0f5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c2af1523299b2ae906db2cfc1bc1eca9f96ff5bcf739238555d11eab67499efe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bd6ed37fff73ea134b5c2e7eef124891ca252106484efbdc80756cc354e3ea56\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"750010eae93e29ff523a99ba4e5ef57554664f3213920e75c1959e2db0176128\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7aac3b22be2aee4090a6d0cb32dd002d0fad5a689857d4e92ee03a950b30e0c9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"74883f5b7e7a852327e008c7e9f03a1d91f98325beeb19c446f62796e6aef8d1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4d1ea02979cfe39c600e55838846c4eee4ddc92bb7fcfb3453cd070bcf3e2959\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"44fc74b91f49727f317f3fdebe4dddd5445c63c7601b59dbb817a847a2a1b2eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a982cae2c9190837d5ea04d6ba343f2ddc2a96065c397c50678676b3e6e6c245\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8bf7acafa93e755f68cfd59460e5a54df9f18ca04f2d003d86d0083de64598fe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6200b66035d445a0e4c1702bf2414c2e8877c2f2c473277de2bc9f6e9bf2fe8e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"035ae7b4aacac45527bf36277a7aad77aa4acceba99af38797fa4f951905ee54\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"34cdd18da494efc76065ea82ac3395638e9aca5c40abbd53c0f4538612f07d35\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w1-7a590a"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w1-7a590a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:11.028Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T12:42:13Z","generation":32,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"13037da2-7ce3-408f-991b-ad31db53d1ff\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:44:45Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"13037da2-7ce3-408f-991b-ad31db53d1ff"}],"resourceVersion":"18597","uid":"044e9012-9183-4278-aac0-7fa080f81471"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"etcdserver: request is too large"}
{"level":"error","ts":"2026-10-30T13:10:11.130Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-7a590a","namespace":"e2e-models-e2e-worker-w1-7a590a","uid":"f9af62f3-67ad-4018-8e68-d1b98a22aebf","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-7a590a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:11.163Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-53dcb1","namespace":"e2e-models-e2e-worker-w4-53dcb1","uid":"1092f88c-7f1b-4d74-9ba7-b9b0fd959b68","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-53dcb1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:11.198Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-10-30T13:10:11.198Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-10-30T13:10:11.371Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"LimitadorLimitsReconciler","operation":"update","resource":"kuadrant-system/limitador","kind":"Limitador.limitador.kuadrant.io","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:11.371Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"IstioExtensionReconciler","operation":"update","resource":"openshift-ingress/kuadrant-e2e-worker-w4-53dcb1","kind":"EnvoyFilter.networking.istio.io","error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w4-53dcb1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:11.371Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"IstioExtensionReconciler","operation":"update","resource":"openshift-ingress/kuadrant-e2e-worker-w1-7a590a","kind":"EnvoyFilter.networking.istio.io","error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w1-7a590a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:11.371Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"IstioExtensionReconciler","operation":"update","resource":"openshift-ingress/kuadrant-maas-default-gateway","kind":"EnvoyFilter.networking.istio.io","error":"etcdserver: request is too large"}
{"level":"info","ts":"2026-10-30T13:10:11.371Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"scheduling retry for non-blocking errors","errorCount":4,"requeueAfter":2}
{"level":"info","ts":"2026-10-30T13:10:11.437Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","Kuadrant","TokenRateLimitPolicy","HTTPRoute","AuthPolicy","Gateway","EnvoyFilter","ConfigMap","Limitador"],"eventTypes":{"create":26,"delete":31,"update":125}}
{"level":"info","ts":"2026-10-30T13:10:11.487Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-10-30T13:10:11.507Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-10-30T13:10:12.081Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-10-30T13:10:12.194Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-10-30T13:10:12.194Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-10-30T13:10:12.194Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-10-30T13:10:12.274Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-10-30T13:10:13.008Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-10-30T13:10:13.008Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-10-30T13:10:13.011Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-10-30T13:10:13.015Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-10-30T13:10:13.015Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-10-30T13:10:13.026Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-10-30T13:10:13.077Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:13.077Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-10-30T13:10:13.374Z","logger":"kuadrant-operator.KuadrantController","msg":"triggering reconciliation retry for non-blocking errors","errorCount":4}
{"level":"error","ts":"2026-10-30T13:10:13.624Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w4-53dcb1","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T12:46:57Z","generation":46,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"ad19e696-52ed-4450-94f1-eded048bba27\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T13:09:57Z"}],"name":"kuadrant-e2e-worker-w4-53dcb1","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w4-53dcb1","uid":"ad19e696-52ed-4450-94f1-eded048bba27"}],"resourceVersion":"83498","uid":"9ec80002-b898-42ba-8857-784b6380ab66"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"25a1c9993b6f4ea69206eb6b230a0d5e752e689ebff241573f64cb0dcfed87bb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fdd2e931d0bc13263b903b61e1e009643cb3cb9f04728983f0a3ad1f80b17c2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05721040781acc43415365dffa14dcbb8008a73032f9fb4236838ae804f27cd9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7bc4fa4dc4148ac1b4dafbf544ddd9d141620d3c180513f76d642f7f7ec70af7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c5f2c0c7936757ece0bd2bc5d5d0172ca7760238d4a1aa4770798563e686071e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"08e10bd762ef9d277835f71d88a02ff17d9288d457fbc20c34f4c0fa61ace29e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0d0c5ad4cf5daf3340df7ec7bc02c0227878b43cc86f681eb8dceb836c188bac\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"77d288314f0282382ba31d8fff80ddccb1ca29df3066d00f7a2d9fc7cf6b06aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29ab17092352c0529d55cf050576da245a70dd62cec1da7912970150bd59a079\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbe36e82df47f6018446263f2720506e0888dad51ebdbd8a452aa39bab62320a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"de83e7795994116b47a6afcb4c300d56e6212f572909b311eebdae742b22db18\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2fa69e45d07440b1d4349b9a6603a14ca661a5cea439561e12cad2ab34bc3787\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c00658935c443bfc6b50aacecd40e2757e1434283a8ff1433611aebc4bfff347\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"99af2676f76182c413086a97bb31d9c67c509d7197fccbb26a9f72924cb9b153\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"865fe8edccec04f5fb55cdfef525c52c270ff0e4a7669ebd90714b892bc6b5ab\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4929a20f544b7005ce186874f90904640440dbf6bcf27f631412f6d0aaf65ee7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b1dfa4f975f7d58a22d462c662503f31664b7344d77150fc12167f31f05ca0a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"dba194f3dbcac655aebddfa3ea98dd2dd486760005d2ff2e87db3b2b445dd235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5905c63b7a6f8479c2bdf582769cf959048fe65bc9d0292d78dff259df383f54\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ac0b09d88152f12160535805c80002cbfb09c9925933ae43bd5d449357ff396a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"39d0af230c6555e4d3c2ee1dc247c36f417b1cc3502e3bed0a588e095410987f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ffef4b578a566be9626a99782a91b7ef0bea204cabe0bc69c5acd09f6c3673d7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a69418c064056026973af3a090f779fbb3dc3ee106c8054a7822cb4bdba759fb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6da0786f468dfd552ade1b11b8c3bfa854fff0f80cdd4b34fd451d8c50f0cf6d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6c547c2167c9135ebd65453f030b83b6bbbbb0e12fc95c7efa6b55331a01a81c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"520b3c828dbcc36acab6d0c5c97168f2df746cea294b070c48a25e4e9c26b26d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"84fcdcffb035aa4df026ea8b182c1d985c4deb171fb09264f5c2b78a7e290054\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"145d954305506b9fba35d76b2657c538b39d74dbeb078381aea86745b7bd64a7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"663790a0510f2693daf89340f00b57d9cb74a7e630de51e1f4e40f5759072963\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c9af5d5096c5c8e060feb79ccbf8348d2d5d819edf39a5dbafd4bd61c28de2b4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7e2454df0aada7fdd8ccd57fac150f260861e6c3472d5bdceeba2460b533958a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2b6f42efd682e1ea0376780340d0f60cef20eabdc177badf8c8ad46bf67daa6f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4c43f9d5f89223314ff24852e7f60990cdcffd391cae2e1728b63cb0cbd8e575\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b09bb280a4a5caa95494a0190d901dcb323926a950e611ffe112fe41c2586a6b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"46fc87d721087034978051b991603b15a1549a42ffd6a9f2d7540fa624d9fbe0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"07a9fbfd845551af5d7e8ad023ca8fb4bca991962b48191e7b9e7ec9f7c9410a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06644eed28a6354f9d9cbd205635366137e6f9a985e0cdf1f830923dc4c32196\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"68ecb87a9879d271a0377e0c71e8bb13fb86e8b9efb884649b22354c53bc0f98\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6ce786297e806878f759f8ebe30957c2bd515f34c8cd580c47396d68b73ee3d1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4806fdc003ab234e5613ac5978afcbb90ad7ee95e124d8b8b68bd3ae14a6a4dd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6ef9659353658fa30f8a50bb13e2e8523254919072f9604a5929a5ceb0a6bc17\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bab2aab3d0a190fbfe76a15bd83bb4d25567457a8ea53642a43efec9950c8eeb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2634d60d3fbc322f122dacc07b9e00083342e7efbe03e17bf65457a826752cf4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5aba94a69f9e6f9f49f506393b4e1f94dcc8c733a154a04211a09d4ccf02889a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eab745772fec776a6f0c7c817900ac89dcc6e3a8917a2bfb414cfb44d3d67989\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d017fd2c0c444c2a18f9ee008dc7cca88e7d3772c4747e4627cd4d1578552705\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"866ba8602385aeaa90e8ae78ada1be9ce63dd09727bf4ecc6c1fa758e828a9bd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"764f95faac255d6894c3b72c3b5d4b3310629e20f3a61e4a24f480cdbb534ccf\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"15ff23dabc113f8de56339b254a90e582a84646a03e6621c05d53289f469023b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f7c94f5addf2a5fafe55d76d5abac3e9e255c9e513b938166b26072dbbe1ff7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"006181ea19644569eba45d273bd8a4fc3b9b2bd4ecbd3ef11fbb23f3a488daba\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a8f18c80abda1bd84eb4ce7401df1b9272f767e6067d1caddc8d7e5560b270c0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8a140385139e5d1094af15ad091323d3ab199555833d87f4aab24de3d072b6e1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f262fc03d8702fd881d8cd47fe5dc53fa2b0caa758bc5f53e1504d4228b89af8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9daf1c7213c63158612c39c6292118e88db3ad9946191083ee2a5a5a42090281\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2d3d2ed379ff94f056ee47d557617cf8e11ef5e053dc91ae59462c063d6bc659\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1e238b7d9e3f5d63d4bb1b2c1e20a3b8446c915d602f4a498ff5e32b26494ce9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"86e5206ca9dda35199b03c7404f14484a0dc9345dc56aa254257dad3fe3045c9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9d94bdb074cd59e0eeb52465f57a2886f3010a3084bca915240c377dfa69371d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"76aef54a15f29a2d7e6a2e90a2bca69a7f7006d2cc855729cfcbe5ed2e20bce6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f09d09fc6dde1d236524d4d6dcb928bdcf139e1b1ce84cce5a5a61d0dfbe9a0d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cbb1929d83c87332ce3ac1c2c7eb219492bfa2b8f14a75142746a20f7533efb3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8013b4888d8c0c89f4fb91ca2c345624f24083cc7b8ea83841c85560e17fd789\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"800ccb9059fb2669e3e7f64e2570052f23cc34e2c5c2df30ea9c882f6a6563a5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"848ef614bc7f06bf3e510719cdaccc63c032f4baa9511a3271180a15243597be\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7538aa8fb0f19ce73bd49b0cf2cc2529f3177a4e22fd00f296706e6193c57c62\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b7fd9eb41424bdbacdb2d2be398f7f3d33ee8577e46641724bb6c847f8a39b50\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8d5f23b63daf3626d0e9d0e10d1d1a2ffbe77f04a3e9ef732a89194f8231d888\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"81e7bc6ff15c5fcf552436509b25c7dfb574a74e08c2e48ee54b9755f92fa90a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"57d7aec31d434be52f7b457c9fb3411b8bed4ba7dd552ddb9a03f4f751b80ce9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"11d94353721e19c51aa0bc6aaf17a915f0c4bc5c5b03c6670c645da71e67b0ab\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c341acb6cdaf59c82cf61b20358dd3839468045103db5ec5c628531e6da465b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e43587797a9f0e99f41485cc6382657fd275bc0456caa79ddfb81c0a3829ce8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"792380c647e80d86421f854ef1b85a93875b66898601b71c4cf2a2e944e593c0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e9a145d980170d0288208e686227f27cf4330221d68aa965fa696259630442c4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9650a227b189b38fd3967a878a7dad544dfa7c3ff95cfcd0a2a874103408d1c7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05daa6d986fd5a49c2023f2b7516d814e699fceafa44c99344553fea00c14848\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6537b6fcd48e7484cc289a8663ad12d6efb1403bebedd27c74627597b05f748b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"19bfec94f9532ea4b5b1ff4e22e34dccda05f7858053828e2a904551707f45dc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea2123826bcdce0fdce2c5a90727e1dd179d03b031c83f0b813d0ae63eb69677\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b7432eac2809c3393fb8b46df502f39f77e27e5e88eff0e8835bfdb185fa9eef\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8950dc33891bcf7b11610edf1c476c4ad48308a70ee7a0715a4ecc0200f0750c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5e2828e21483a361ca7af9667f8d2d5b6b368fff80e00b61868847aed179c479\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e54452bb832f5639f81eea8108710ae6b8208c72f43891f5d68e3738c7045204\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"104f9b7f51a3df1f9430904dedb3f7a4cf21c6cc4c20557200b5472ed316a34b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9ba0e3c245ec075a8ac59e90542272767b57e107405871ea949b889ee6539e55\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d277167c1aa8cacaa4008b08884917c3bf967bff3e5581e0d555489ad3f97e24\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"36062c03d9e26d06762aa1187aebb222e71f039151b2c623f6b5367983de7d70\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"671fede733c21121c0fa91b5b6cadbeceb86fb48425b13fa2b5f9d78803a82f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"407d064e9fb88cdc3971fe2d6bf8c9b1420f29af1ffc535d11bb7ed27b64ff42\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"282fb13e85739e757462864ee696b3b5e995491369e9a8b047440bf7e1681190\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3b93464ed862579d468647c5a4c3b4bb20cd49b9fbc1508ab9a76bc02c103875\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d23d6b45289810b57bcf4421cc3f6d7a9b00af854de8d617d6f29562dd513117\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8f0952e906a65a8f638e31655c86ef2b14fcb462735baf16d752c564ec3685f0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2a63b0542f7d5e9ab21ff2a70e875d9016c654a34be4af8b2862093443d15c51\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f87733d531f5c5ac690831f7810e82ab2fa83c91261b4620c531b6c1e2597408\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"17173ba26c2e665c9e0e4ef6ffc67fd759e864382b5cbe50edc98a2bdae7ddd4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"26b154581e3881356d524a47c977002fcebf8fc95f12b0fe9e16ff9bc93b6869\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b444fff7c731702df9c43dd18a342ed5f4b84acbd2ae2c04e246e2ddadc11c94\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7dd0d1de5baa211489652a3c15f430b8d98c560c8a2d48d601fecea8ef647fe0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7cd969c2f8771fba44a7e483980f071aa82ff99f59db04390ca78ff143e778c0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1428a708edeea422ef4b9716589806d329bf8845f820bfe5bc7178813f441d85\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"076a038410428b9ac2bad029581c01b28cffd7b7f1a64c56465ca488c625b3c5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4c02356413d5b89c13f5a61a96468b87adeed2b50bd1a06310c89906490d0ef4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"50f9f35158468854257f3b1da534aee4a02c5f37c0b91fe1a72899c341660094\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7b9be35bff6fdec58573ed2c1a1152fcbea438cef2475fc4cc9c903209a01c16\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4917cb32e7b2094a58f1559c0d805212c1f0a354154ff0d6718a8463e5565d99\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5504d0ebc213428e8e60ba1b109351cf7131650f3094706e423b22777e0a6a2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c2d72b7f90bb96f33e2e1b00416be5fdbcedf88bc9b8577dd76935f6319a4e60\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"595ee786cd23b52cf9e2dc51a3ee8f43ca72d2ecc929144b3271d8f106843faa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce47c00ef51de8c42dff484190186d5315e9812635a34ef8cbec474b4571879a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a75be581b7a86b2a2c0f39b442e1fa507ea04ff01e418ef580566cfbccf215d7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5b7b766a72874acf9e8163ee483bc3d2370257bc288a07afd179471595fc5c6d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b205f794a68f488c4a8f87b688181870575e9b6ca3b2a00df6f22524886338aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce573b3027ad9607006464b4e16f49dcac328bda3098dc2f9cbf0de48aa9d1a3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1c971719638c32dc812964dd616c6226115934f0909c7b85ed98644b854b3cb5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ebf2ac513888626165cd2d0790db586c2e4365bfc263ad07ac289ad50a7f0ae7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"489c62d558d8722de6ee3dcfd2c48a08927d2cdbf9949a248345c4f615f73f62\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9a0f225cd047dcdb3f4867b212ef3e6dec20d7e8a4fca7af06293fb5c507b2a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"91af9bbd342d70e7ded90a99ca79e9232c49add440a0baa7506ff0f8fcb7b531\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4f9ad3ea2cb0afdd240e7a999cacd6f99c830a43e8d5ae688123da58c428bec2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96425c7ab5b8711bc556881ccc5c39b9c0666aa833805063b33ba887d4a5a819\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8c0cd107e1fa6f004c9af05b8c3102f19ebfd173ca67bf6c06fdd17256eaba05\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0d3bea7d8f4148509a7b4fdd379c391351993a4406d93efebab9d2e3a0fb2cb6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"054858abf03d49266e8b2b24aacaec6285f09f0adfa2239155a173261bdcca7c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3df8116a7d69f8b78dff00107df12558b13101576f05fa1c19384020dc817adf\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"13caff03101ec8fb67cc6985c5efbc26b786120381d2d76f2515fdb6fe7706e9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"62b30c6ad3a9fcfa5ee595e3c4ec2739df9ba145321ad1f24428f133ada2d563\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d698cb3490c21dc5d10c6de9a6bc389ce436a75532ce382d151ae459332e57ee\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f8ea478a97a900e8d13e31f88e44d56eb6952feee907f3e774a95b8e3de26382\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3ae6be995c08f6214b9af6f7ee2efd55d8f0b2fb8b2e04829e5955c670b7b74d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"264d2df2ea589600cf328e148b762248ac5130839cf3859470c36a43292ff4b1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w4-53dcb1"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w4-53dcb1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:13.868Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w1-7a590a","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T12:47:09Z","generation":42,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"59691ce6-45f9-466f-95b0-37ea51621f91\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T13:09:57Z"}],"name":"kuadrant-e2e-worker-w1-7a590a","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w1-7a590a","uid":"59691ce6-45f9-466f-95b0-37ea51621f91"}],"resourceVersion":"83510","uid":"bd8113b0-02c2-4ef6-ac7b-70f5da056591"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"089b88945c3f987cbd854645d335b1ed3f87d04e17e66f7e7d584e52c1c5293b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"782eb2b86655a7063ec50aeb50761ba028d5aff1c427b9c596182c02806eaa12\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2e367576ea8266051677e41fdcbf708227a0071dfb69638dc9f83fdd7d99ea86\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"abb38e7df8d6f08cddb11f57c793dd67cbfaa03e64e7203c1d0a6a9b4782282a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"393f2fdfebf241dcbaa0ae443b32e566084dad1b7c8cf4e6237de95a20ca10df\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"eccb2b7077041a6c5473fcb6f9dd58485e0f96567711421f1cea5cb80bfd0ccc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ab71c1c7c2dccd7c72591861016e3908312803953aee1a08f892ce78b33659fa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2458c735ddded8f7ebd5cdf1cfa73d33af85f1b4f5afa47ef1a360353df8c13e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a00bce455a8ba0c28f513d2cbb3426dff48ac572de4a180ceb56690724d00b35\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f93480a53e523b496c9412cfc58e7f75d121f2d651ea3172486dd7ddcc2ebf35\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4088f3063b27f9d26c95d8b4cc13218e60e59c7f63fece214340d3f0068f6909\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e8b2d8d9ec8f38b9b28942d9c36865b0222b1ca9d82d0f0809e2edc99917ff2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a736aff22b9f2c7af9549b13acf51819f8e99aa04b373d0fb5fbfff688b50cd2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"15900836e6f269b428a7ba51ef7d8dc0a7ca36c301a71f45a53f5f1c4a79ba0b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6cf8ff0bc2509d8cdb34100efac4ca00ad38423a4de09b25ae7f459379466a87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1a6fa01f3aa9c2d26611604900e9a0441bd093c5e19a824325c7f168cb47b11c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"36cb6cbb20273aad26612a19dd5f6c3efe2c9dd2c600f17ad0a915ef88d8b954\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"63b15ec160e5c3f65f606ccd476d6758762dc51865d27e9f2dc6d6ed47ec9551\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0ce7632c4354c0c227fddad698833ef251d10cefef7f25005691c0fadd7534b1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9e544a6ff3c5e4acbe799f06b93f4543c4988fff030e587768dfe9defb00adb0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3e115bb8bf2d55d71e7f9990370dc806ef02b0c5eb99439f32e357c379411367\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a065802be295503b7704c19b0b67b8359647e2add0f49d96146ed9826862d379\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a13d202396b9f03f9e7deb7b13b75b922053e1590d404210385aecaf73a5ca5f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cf188fd4e6d9497fe145323333d65c5de891abbe18df379b2c386769a6533c6f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d6490111a2bd671f3cc91af93da068c37ea6368b20512943eff2ebfeb9e7d117\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b7e6f5a5af1e174b1ee883237807902e5e8d83f39a3be55b585d44cdbecff572\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4ad3ddfc2a3be8b29229c40c95a4b848a9ba651d362feb03479f7b823e10f545\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"539d95d0b5c7e895aefe94233065bd18082830b3fea6a9277ca55a0da71340b3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8db81c68936ba298f790897b302b150bd12d2eec22154ddf944de0192d7f4b4c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c31eb0b4a50b2c61a2954216dce8a56e9cb3b868cf31d217e6d3d57c4b74fd9e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"09e967c8402e6e306f4b71e6a00f60bd434f2bce2c9d59dff1695d35697dc4dc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6aa87f2820fa15854a304fb36e50d7cee4820128539073fc15bb69753599e132\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3f89ae75a20ba19970a54ccc348cc608ebfca7566239d4f9b158f43febd42e55\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9eada5130b36b41e1e1266aa1092c165e97662a21634ed8ec0460d824bc7e7b9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ae63d00fa381b265866cb1b277633e2a155b94de180c6acefe93b77f7e35e7d3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bd16c47d55fdb5e0ae8240ed986c78707a88611b66b44fae5ab86cb758c215c2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e85025d98da554ebf7c487d2062eb7fa47a1b3d6adb7b480115a5ce4cefb0483\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"836df2ea33f6af85c72799cdb8019385010401c873eb9b12a0e6c749eeb56668\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8c4d0e21c666fd015a2db768ffb20bedac801efe539190c06ca7594e9010af8c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"41b85dccaa8cfcafa7d210e7cd2b1c31420b2b2efdf0b87f46a00d62669b0727\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c92a5de0eff7788429bc28fdec8d86609bf02b5fbedce82308479d1706288bec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0ddfa7441f1dbf1ef599148ed77f7bc3072873b1ec449858709aa517261dff6a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"55e675544ade227ac183e9688220aab677d3e3a4d82332e06ed1f425d673a304\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"573b340bccee4a5264ad13b0495d2a6b1e723bb0fe81a6ea97352001ebc74284\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a149d9912ccbb2cd4dd7e07e1172f90c639e64a98b99b9a1967bc3c9bf5d8205\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"609ddabc6778b868f1f0bc5795c071230a76ff3193b26ff5dfa7be54b1c5a36f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"068abb543fe2d8904c85c4227e66d1127808e1da52374db674dc113c87dc522c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdd84071c7d83946e35acff99c9c5b580e876d0c4866c006f5f02e0a107cdd19\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9ce8c2fa3380caeba39c62cfdb2e02b46776e4eac1f908f418140d9b7b883fe2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3586b85b746666dda45c0149c8b212ef8c2b5c5169e2f39c5d3154b119922636\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a5785a5c9d1c12ba13cd603c475c38ef808a12f3823a420b722dc3d70a23c624\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"929ffee0abc41c7a806ffd074e4cfab69d7dfd28eb926dc373bad2330b28a299\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b457a46f3c297a562935e2446d9043cdc1001219a34f31aa169362f32a741476\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ad0f8be0fcd3482ffc4dcce070db2233c156a97a5caf0ba8f88af3eb9789ca93\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"10edd1ae6c0df8a5a1b0594a6fb7b99897fa2d890c87aa6828ecbf4c438a7e03\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6406218469c6248feb077866776924189ca35825c99557888fce19ff8ad56df6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f0f1429576f1a1be321185e1bd6abb819aea50327fda0269d5612db65c382cfd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"75caeb2fecf39c98a65022db57b8b7402a53d8e3bbbbd1058c2a1344df78adfc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4c7e28c4ea66d3867db6e2053d338fd95c76975fa4ce24e65e7850a19b58e263\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"51885626998fd07a952d2366626fa9c9042a4fcef22103bb3076cdc7d2e1e952\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"96a10edf633153472e430c6c2106fabd9d088950913cb891f8d1131e8e85d5da\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ed976c06c4ca362c858910c3dccd54c51c7d22e06a10186b205bc19289bb4d8f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9fcc31bf477a6a539b09c1dafa0d8c389f6af32511fb4c214235577254b96a22\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"04b63ca6998dad8b1e7eed5109e0fa6e6afcad35fbb0aa65553b2ee5aa7c8240\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3a378a4162f02d06b635ffcd9cd97fb7c9975eac68f0d956efd8c3576a6c096c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"559d1da3a3af0f4a6de89f3ed2ff6387393bc8df7d2069266776fab4a9e58b5d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"82a9c25434b61c4772a1ac29246cbb75b1b553266861c57cdeeb5d939581bbaa\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"268824ed95ae571b569392c28a2f752ebe783a99f1990997fbf3d40d303b735b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"df21e7cfc8f3ee440a1487e95ff0c570ae804b786dd01a0d794bd1f3a9985389\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"78b3f9dfb7975e736779a46c7634f04113fea0c5fea7f904b45d4e20a637b245\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d15c406a43328781f512c3e6de986a018b3122ac39a7a4cbc136e998b2b48492\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"76f0f35cf466cedfbe1e34a2e63b4cdd3526f8da2eb57738bb657765040daf5b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e3eeda6dee0071c64c151bbb71350df5353b1c91473127cebe525b54a04ae2cc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"223d764a35e77651bb2257681287c29021eb09722bfc90c7265d02c5ba32cf5e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f41fcbb289a766d6a29268d2be644d886254d678311240795320efb90fdad5eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8395b1e94560ed62d84241a4f665ffff31837260cc9aea35c39d3c05175e3026\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b42d2ea2a5c62b1cba47bae62d396ed1c6451087f098340f79cc1ed15366e415\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"12ea3d26783f57b1d94da52ab6a5901ce98ed4b15dec468549f4012dafa05a23\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"daeca0bfe6a614d446a745f7a44cc67f378c849fbedaa1026e4914166e275650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7fb3347fe6c52798901732dc2685b483e2f0c905d248d89deecc83d92553d1c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1cc8f595efea76e0d3eedd32969d77ea8835ab68928410c6c8b033bf46f72923\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d980c3fc378b4f381adb615552ff0fc69397031c7df24757a73c4edf99162fc0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0adc57d51b35181d57ce7070149cb9dcb5a1c35659398baa1c2c66f130cf379f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a8939b3047ea77ce4de1421d66edd7fbcabaf6b680b0966fae12c9f2b8db7f47\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1ae748d971f49d47d371205b68e94c4d734abb4b723a86bcb07504627759dc89\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1736265c5ca3ff6ef8615dbb050d5afa5d5f07e06104e6e51bb14c17e58043e6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"23aab9fbc666b3e1b9b9e93c16a3f2a3603bc75c70d345208c83efb52c885c12\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"daebbb1a2f4340f3d13a56b86dc4092ce39c6919fdc16213b9251d005dc65bb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"30449cf39f411e1cc4fa580c9f841e231a5d83f9d8c88b5c2dab8b705d0f2b52\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2d5c153474ffbe61aefeb835638d7c68a30f6a8885318889cc87590a7f453a0a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1031e5fe412033da350814ac517fe44eb0eae32dbb531ffb2414912a07a0c15f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9c50fa0064a87ebd762cb4ac0b4dc0e17c2eea32530860448d0a09c94b7e47cf\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eceaa3373eca8aa1fa797e413753c17981f4395ea7c9e6478abf3dbb81e8216b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"741d1c871aa8bc86392a31b6ba5abccc2350355d6463723ec4a6627598f3ddf9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cdf3e72f09d9c23ed7de62e42d53e35a45b58ea6979b92283ba6e44040223a64\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c315208fda098a36b225a63347f5fd4c7ec4c6a07535d21d4963c136d75dda8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f1891bb22a9e5664f3026841b58d9ab6c8ff3d4c1597f502e3c8daf82fd67c78\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b3baf3122d7f4fb81c398e67dce1c007a39d77c1b944b2eb6d102ea948b9366e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2906b56422a5d1e18029f8dfe9f583868b1f6413dbb86a0e4489258e2491aee2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea79ff6eb5f370812a6f750d2a475542d4729e79ab7de6f1e3b51b10c9ff15f4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"53525895e62d7603774165b95492f86a299a94e811b8bfa096068557dc3b7079\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0aabe65457a62852cbc3f5efd4c9afd908cc365b81ff4ccff45d69457999be4f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8efe4c813ac88cde94cfd4bea026c778ccd1fc314df55d6fc5a83b02e37d153e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a5e8be6e6efa0995666cde2b04ee89d684553a2c184ce9d65be941363760f6aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a8c66d50ffdf82d6ecae69a1c0971f324d61cb035754e672c09e1374920c130f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3a98a433d7e13f7037d129fb607c0aa6be8e2786ab529798075891f1caa2e2a6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9aa33d1f7ee5b6f87dfab107560c9553ff008f5f640805b76152726175c3c7a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ef747846c68074cb6f3e6a721fe746c946c0fd87b764ad0f32c0db14a530760c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"105f27cff377e7455202b357006b2ff9c435dd06d077a77766a438b920e65ecb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6ea9e47cbae52d5f98c27737783d0dc37f05ed89537af90900d99ba724786368\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b53dd5318f075895d6819e8d4ceffc9d62fa37419025365efad5d4c37c032ae2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a4fbcc35d3dd061cbfe1038d04f72a085a63f22e6e41e51732d576dcf511ae51\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"774123679310f86a6cee928712e1340beda60d2cfd92fbbd2c0879a79005ee42\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c845c4a191326e7c9ecf6da0b052a10671217a1380a0016bca9315386f48ca03\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dde723c1559b7f93ce7e2cffbcf1cf349ad8c296646082c81a7499be56862cd1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9d8f49969e71ac351537bf21d0ed0bc0dc5eb1695291c30737b293be5df9682f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"22b1883b4b523fcb5aa2347e32fc0852b420c0da88d30eb8ccec885b0647939d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9dc5ba2a85da2966998ed0d77f55d9da2820d7f5d7306991557614037e39a0cc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3a4b1c0e3136e893a0ff6adebc7676449cb25c1230b5628462c88499dc931fae\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c7c1445e34f1134341c70b2411f384cfef83a00287915d9a085d8ab6d61f0f5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c2af1523299b2ae906db2cfc1bc1eca9f96ff5bcf739238555d11eab67499efe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bd6ed37fff73ea134b5c2e7eef124891ca252106484efbdc80756cc354e3ea56\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"750010eae93e29ff523a99ba4e5ef57554664f3213920e75c1959e2db0176128\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7aac3b22be2aee4090a6d0cb32dd002d0fad5a689857d4e92ee03a950b30e0c9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"74883f5b7e7a852327e008c7e9f03a1d91f98325beeb19c446f62796e6aef8d1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4d1ea02979cfe39c600e55838846c4eee4ddc92bb7fcfb3453cd070bcf3e2959\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"44fc74b91f49727f317f3fdebe4dddd5445c63c7601b59dbb817a847a2a1b2eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a982cae2c9190837d5ea04d6ba343f2ddc2a96065c397c50678676b3e6e6c245\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8bf7acafa93e755f68cfd59460e5a54df9f18ca04f2d003d86d0083de64598fe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6200b66035d445a0e4c1702bf2414c2e8877c2f2c473277de2bc9f6e9bf2fe8e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"035ae7b4aacac45527bf36277a7aad77aa4acceba99af38797fa4f951905ee54\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"34cdd18da494efc76065ea82ac3395638e9aca5c40abbd53c0f4538612f07d35\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w1-7a590a"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w1-7a590a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:14.345Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T12:42:13Z","generation":32,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"13037da2-7ce3-408f-991b-ad31db53d1ff\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:44:45Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"13037da2-7ce3-408f-991b-ad31db53d1ff"}],"resourceVersion":"18597","uid":"044e9012-9183-4278-aac0-7fa080f81471"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"etcdserver: request is too large"}
{"level":"error","ts":"2026-10-30T13:10:14.491Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w1-7a590a-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w1-7a590a-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:14.522Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-53dcb1","namespace":"e2e-models-e2e-worker-w4-53dcb1","uid":"1092f88c-7f1b-4d74-9ba7-b9b0fd959b68","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-53dcb1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:14.537Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w4-53dcb1-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w4-53dcb1-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:14.554Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-7a590a","namespace":"e2e-models-e2e-worker-w1-7a590a","uid":"f9af62f3-67ad-4018-8e68-d1b98a22aebf","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-7a590a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:14.571Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-10-30T13:10:14.571Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-10-30T13:10:14.670Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthPolicyStatusUpdater","operation":"update","resource":"openshift-ingress/e2e-worker-w1-7a590a-maas-auth","kind":"AuthPolicy.kuadrant.io","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w1-7a590a-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:14.670Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthPolicyStatusUpdater","operation":"update","resource":"openshift-ingress/e2e-worker-w4-53dcb1-maas-auth","kind":"AuthPolicy.kuadrant.io","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w4-53dcb1-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:14.670Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"scheduling retry for non-blocking errors","errorCount":6,"requeueAfter":2}
{"level":"info","ts":"2026-10-30T13:10:14.750Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","TokenRateLimitPolicy","EnvoyFilter","ConfigMap"],"eventTypes":{"update":6}}
{"level":"info","ts":"2026-10-30T13:10:14.778Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-10-30T13:10:14.789Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-10-30T13:10:15.197Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-10-30T13:10:15.276Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-10-30T13:10:15.389Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-10-30T13:10:15.389Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-10-30T13:10:15.980Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-10-30T13:10:15.983Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-10-30T13:10:15.985Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-10-30T13:10:15.986Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-10-30T13:10:15.986Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-10-30T13:10:16.000Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:16.000Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-10-30T13:10:16.671Z","logger":"kuadrant-operator.KuadrantController","msg":"triggering reconciliation retry for non-blocking errors","errorCount":6}
{"level":"error","ts":"2026-10-30T13:10:16.820Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T12:42:13Z","generation":32,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"13037da2-7ce3-408f-991b-ad31db53d1ff\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:44:45Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"13037da2-7ce3-408f-991b-ad31db53d1ff"}],"resourceVersion":"18597","uid":"044e9012-9183-4278-aac0-7fa080f81471"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"etcdserver: request is too large"}
{"level":"error","ts":"2026-10-30T13:10:17.093Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w4-53dcb1","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T12:46:57Z","generation":46,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"ad19e696-52ed-4450-94f1-eded048bba27\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T13:09:57Z"}],"name":"kuadrant-e2e-worker-w4-53dcb1","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w4-53dcb1","uid":"ad19e696-52ed-4450-94f1-eded048bba27"}],"resourceVersion":"83498","uid":"9ec80002-b898-42ba-8857-784b6380ab66"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"25a1c9993b6f4ea69206eb6b230a0d5e752e689ebff241573f64cb0dcfed87bb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fdd2e931d0bc13263b903b61e1e009643cb3cb9f04728983f0a3ad1f80b17c2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05721040781acc43415365dffa14dcbb8008a73032f9fb4236838ae804f27cd9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7bc4fa4dc4148ac1b4dafbf544ddd9d141620d3c180513f76d642f7f7ec70af7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c5f2c0c7936757ece0bd2bc5d5d0172ca7760238d4a1aa4770798563e686071e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"08e10bd762ef9d277835f71d88a02ff17d9288d457fbc20c34f4c0fa61ace29e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0d0c5ad4cf5daf3340df7ec7bc02c0227878b43cc86f681eb8dceb836c188bac\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"77d288314f0282382ba31d8fff80ddccb1ca29df3066d00f7a2d9fc7cf6b06aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29ab17092352c0529d55cf050576da245a70dd62cec1da7912970150bd59a079\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbe36e82df47f6018446263f2720506e0888dad51ebdbd8a452aa39bab62320a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"de83e7795994116b47a6afcb4c300d56e6212f572909b311eebdae742b22db18\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2fa69e45d07440b1d4349b9a6603a14ca661a5cea439561e12cad2ab34bc3787\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c00658935c443bfc6b50aacecd40e2757e1434283a8ff1433611aebc4bfff347\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"99af2676f76182c413086a97bb31d9c67c509d7197fccbb26a9f72924cb9b153\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"865fe8edccec04f5fb55cdfef525c52c270ff0e4a7669ebd90714b892bc6b5ab\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4929a20f544b7005ce186874f90904640440dbf6bcf27f631412f6d0aaf65ee7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b1dfa4f975f7d58a22d462c662503f31664b7344d77150fc12167f31f05ca0a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"dba194f3dbcac655aebddfa3ea98dd2dd486760005d2ff2e87db3b2b445dd235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5905c63b7a6f8479c2bdf582769cf959048fe65bc9d0292d78dff259df383f54\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ac0b09d88152f12160535805c80002cbfb09c9925933ae43bd5d449357ff396a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"39d0af230c6555e4d3c2ee1dc247c36f417b1cc3502e3bed0a588e095410987f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ffef4b578a566be9626a99782a91b7ef0bea204cabe0bc69c5acd09f6c3673d7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a69418c064056026973af3a090f779fbb3dc3ee106c8054a7822cb4bdba759fb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6da0786f468dfd552ade1b11b8c3bfa854fff0f80cdd4b34fd451d8c50f0cf6d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6c547c2167c9135ebd65453f030b83b6bbbbb0e12fc95c7efa6b55331a01a81c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"520b3c828dbcc36acab6d0c5c97168f2df746cea294b070c48a25e4e9c26b26d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"84fcdcffb035aa4df026ea8b182c1d985c4deb171fb09264f5c2b78a7e290054\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"145d954305506b9fba35d76b2657c538b39d74dbeb078381aea86745b7bd64a7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"663790a0510f2693daf89340f00b57d9cb74a7e630de51e1f4e40f5759072963\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c9af5d5096c5c8e060feb79ccbf8348d2d5d819edf39a5dbafd4bd61c28de2b4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7e2454df0aada7fdd8ccd57fac150f260861e6c3472d5bdceeba2460b533958a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2b6f42efd682e1ea0376780340d0f60cef20eabdc177badf8c8ad46bf67daa6f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4c43f9d5f89223314ff24852e7f60990cdcffd391cae2e1728b63cb0cbd8e575\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b09bb280a4a5caa95494a0190d901dcb323926a950e611ffe112fe41c2586a6b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"46fc87d721087034978051b991603b15a1549a42ffd6a9f2d7540fa624d9fbe0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"07a9fbfd845551af5d7e8ad023ca8fb4bca991962b48191e7b9e7ec9f7c9410a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06644eed28a6354f9d9cbd205635366137e6f9a985e0cdf1f830923dc4c32196\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"68ecb87a9879d271a0377e0c71e8bb13fb86e8b9efb884649b22354c53bc0f98\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6ce786297e806878f759f8ebe30957c2bd515f34c8cd580c47396d68b73ee3d1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4806fdc003ab234e5613ac5978afcbb90ad7ee95e124d8b8b68bd3ae14a6a4dd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6ef9659353658fa30f8a50bb13e2e8523254919072f9604a5929a5ceb0a6bc17\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bab2aab3d0a190fbfe76a15bd83bb4d25567457a8ea53642a43efec9950c8eeb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2634d60d3fbc322f122dacc07b9e00083342e7efbe03e17bf65457a826752cf4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5aba94a69f9e6f9f49f506393b4e1f94dcc8c733a154a04211a09d4ccf02889a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eab745772fec776a6f0c7c817900ac89dcc6e3a8917a2bfb414cfb44d3d67989\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d017fd2c0c444c2a18f9ee008dc7cca88e7d3772c4747e4627cd4d1578552705\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"866ba8602385aeaa90e8ae78ada1be9ce63dd09727bf4ecc6c1fa758e828a9bd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"764f95faac255d6894c3b72c3b5d4b3310629e20f3a61e4a24f480cdbb534ccf\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"15ff23dabc113f8de56339b254a90e582a84646a03e6621c05d53289f469023b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f7c94f5addf2a5fafe55d76d5abac3e9e255c9e513b938166b26072dbbe1ff7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"006181ea19644569eba45d273bd8a4fc3b9b2bd4ecbd3ef11fbb23f3a488daba\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a8f18c80abda1bd84eb4ce7401df1b9272f767e6067d1caddc8d7e5560b270c0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8a140385139e5d1094af15ad091323d3ab199555833d87f4aab24de3d072b6e1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f262fc03d8702fd881d8cd47fe5dc53fa2b0caa758bc5f53e1504d4228b89af8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9daf1c7213c63158612c39c6292118e88db3ad9946191083ee2a5a5a42090281\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2d3d2ed379ff94f056ee47d557617cf8e11ef5e053dc91ae59462c063d6bc659\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1e238b7d9e3f5d63d4bb1b2c1e20a3b8446c915d602f4a498ff5e32b26494ce9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"86e5206ca9dda35199b03c7404f14484a0dc9345dc56aa254257dad3fe3045c9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9d94bdb074cd59e0eeb52465f57a2886f3010a3084bca915240c377dfa69371d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"76aef54a15f29a2d7e6a2e90a2bca69a7f7006d2cc855729cfcbe5ed2e20bce6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f09d09fc6dde1d236524d4d6dcb928bdcf139e1b1ce84cce5a5a61d0dfbe9a0d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cbb1929d83c87332ce3ac1c2c7eb219492bfa2b8f14a75142746a20f7533efb3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8013b4888d8c0c89f4fb91ca2c345624f24083cc7b8ea83841c85560e17fd789\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"800ccb9059fb2669e3e7f64e2570052f23cc34e2c5c2df30ea9c882f6a6563a5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"848ef614bc7f06bf3e510719cdaccc63c032f4baa9511a3271180a15243597be\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7538aa8fb0f19ce73bd49b0cf2cc2529f3177a4e22fd00f296706e6193c57c62\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b7fd9eb41424bdbacdb2d2be398f7f3d33ee8577e46641724bb6c847f8a39b50\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8d5f23b63daf3626d0e9d0e10d1d1a2ffbe77f04a3e9ef732a89194f8231d888\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"81e7bc6ff15c5fcf552436509b25c7dfb574a74e08c2e48ee54b9755f92fa90a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"57d7aec31d434be52f7b457c9fb3411b8bed4ba7dd552ddb9a03f4f751b80ce9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"11d94353721e19c51aa0bc6aaf17a915f0c4bc5c5b03c6670c645da71e67b0ab\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c341acb6cdaf59c82cf61b20358dd3839468045103db5ec5c628531e6da465b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e43587797a9f0e99f41485cc6382657fd275bc0456caa79ddfb81c0a3829ce8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"792380c647e80d86421f854ef1b85a93875b66898601b71c4cf2a2e944e593c0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e9a145d980170d0288208e686227f27cf4330221d68aa965fa696259630442c4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9650a227b189b38fd3967a878a7dad544dfa7c3ff95cfcd0a2a874103408d1c7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05daa6d986fd5a49c2023f2b7516d814e699fceafa44c99344553fea00c14848\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6537b6fcd48e7484cc289a8663ad12d6efb1403bebedd27c74627597b05f748b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"19bfec94f9532ea4b5b1ff4e22e34dccda05f7858053828e2a904551707f45dc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea2123826bcdce0fdce2c5a90727e1dd179d03b031c83f0b813d0ae63eb69677\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b7432eac2809c3393fb8b46df502f39f77e27e5e88eff0e8835bfdb185fa9eef\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8950dc33891bcf7b11610edf1c476c4ad48308a70ee7a0715a4ecc0200f0750c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5e2828e21483a361ca7af9667f8d2d5b6b368fff80e00b61868847aed179c479\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e54452bb832f5639f81eea8108710ae6b8208c72f43891f5d68e3738c7045204\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"104f9b7f51a3df1f9430904dedb3f7a4cf21c6cc4c20557200b5472ed316a34b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9ba0e3c245ec075a8ac59e90542272767b57e107405871ea949b889ee6539e55\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d277167c1aa8cacaa4008b08884917c3bf967bff3e5581e0d555489ad3f97e24\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"36062c03d9e26d06762aa1187aebb222e71f039151b2c623f6b5367983de7d70\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"671fede733c21121c0fa91b5b6cadbeceb86fb48425b13fa2b5f9d78803a82f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"407d064e9fb88cdc3971fe2d6bf8c9b1420f29af1ffc535d11bb7ed27b64ff42\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"282fb13e85739e757462864ee696b3b5e995491369e9a8b047440bf7e1681190\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3b93464ed862579d468647c5a4c3b4bb20cd49b9fbc1508ab9a76bc02c103875\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d23d6b45289810b57bcf4421cc3f6d7a9b00af854de8d617d6f29562dd513117\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8f0952e906a65a8f638e31655c86ef2b14fcb462735baf16d752c564ec3685f0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2a63b0542f7d5e9ab21ff2a70e875d9016c654a34be4af8b2862093443d15c51\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f87733d531f5c5ac690831f7810e82ab2fa83c91261b4620c531b6c1e2597408\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"17173ba26c2e665c9e0e4ef6ffc67fd759e864382b5cbe50edc98a2bdae7ddd4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"26b154581e3881356d524a47c977002fcebf8fc95f12b0fe9e16ff9bc93b6869\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b444fff7c731702df9c43dd18a342ed5f4b84acbd2ae2c04e246e2ddadc11c94\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7dd0d1de5baa211489652a3c15f430b8d98c560c8a2d48d601fecea8ef647fe0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7cd969c2f8771fba44a7e483980f071aa82ff99f59db04390ca78ff143e778c0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1428a708edeea422ef4b9716589806d329bf8845f820bfe5bc7178813f441d85\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"076a038410428b9ac2bad029581c01b28cffd7b7f1a64c56465ca488c625b3c5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4c02356413d5b89c13f5a61a96468b87adeed2b50bd1a06310c89906490d0ef4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"50f9f35158468854257f3b1da534aee4a02c5f37c0b91fe1a72899c341660094\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7b9be35bff6fdec58573ed2c1a1152fcbea438cef2475fc4cc9c903209a01c16\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4917cb32e7b2094a58f1559c0d805212c1f0a354154ff0d6718a8463e5565d99\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5504d0ebc213428e8e60ba1b109351cf7131650f3094706e423b22777e0a6a2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c2d72b7f90bb96f33e2e1b00416be5fdbcedf88bc9b8577dd76935f6319a4e60\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"595ee786cd23b52cf9e2dc51a3ee8f43ca72d2ecc929144b3271d8f106843faa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce47c00ef51de8c42dff484190186d5315e9812635a34ef8cbec474b4571879a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a75be581b7a86b2a2c0f39b442e1fa507ea04ff01e418ef580566cfbccf215d7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5b7b766a72874acf9e8163ee483bc3d2370257bc288a07afd179471595fc5c6d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b205f794a68f488c4a8f87b688181870575e9b6ca3b2a00df6f22524886338aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce573b3027ad9607006464b4e16f49dcac328bda3098dc2f9cbf0de48aa9d1a3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1c971719638c32dc812964dd616c6226115934f0909c7b85ed98644b854b3cb5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ebf2ac513888626165cd2d0790db586c2e4365bfc263ad07ac289ad50a7f0ae7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"489c62d558d8722de6ee3dcfd2c48a08927d2cdbf9949a248345c4f615f73f62\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9a0f225cd047dcdb3f4867b212ef3e6dec20d7e8a4fca7af06293fb5c507b2a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"91af9bbd342d70e7ded90a99ca79e9232c49add440a0baa7506ff0f8fcb7b531\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4f9ad3ea2cb0afdd240e7a999cacd6f99c830a43e8d5ae688123da58c428bec2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96425c7ab5b8711bc556881ccc5c39b9c0666aa833805063b33ba887d4a5a819\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8c0cd107e1fa6f004c9af05b8c3102f19ebfd173ca67bf6c06fdd17256eaba05\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0d3bea7d8f4148509a7b4fdd379c391351993a4406d93efebab9d2e3a0fb2cb6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"054858abf03d49266e8b2b24aacaec6285f09f0adfa2239155a173261bdcca7c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3df8116a7d69f8b78dff00107df12558b13101576f05fa1c19384020dc817adf\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"13caff03101ec8fb67cc6985c5efbc26b786120381d2d76f2515fdb6fe7706e9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"62b30c6ad3a9fcfa5ee595e3c4ec2739df9ba145321ad1f24428f133ada2d563\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d698cb3490c21dc5d10c6de9a6bc389ce436a75532ce382d151ae459332e57ee\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f8ea478a97a900e8d13e31f88e44d56eb6952feee907f3e774a95b8e3de26382\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3ae6be995c08f6214b9af6f7ee2efd55d8f0b2fb8b2e04829e5955c670b7b74d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"264d2df2ea589600cf328e148b762248ac5130839cf3859470c36a43292ff4b1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w4-53dcb1"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w4-53dcb1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:17.329Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w1-7a590a","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T12:47:09Z","generation":42,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"59691ce6-45f9-466f-95b0-37ea51621f91\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T13:09:57Z"}],"name":"kuadrant-e2e-worker-w1-7a590a","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w1-7a590a","uid":"59691ce6-45f9-466f-95b0-37ea51621f91"}],"resourceVersion":"83510","uid":"bd8113b0-02c2-4ef6-ac7b-70f5da056591"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"089b88945c3f987cbd854645d335b1ed3f87d04e17e66f7e7d584e52c1c5293b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"782eb2b86655a7063ec50aeb50761ba028d5aff1c427b9c596182c02806eaa12\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2e367576ea8266051677e41fdcbf708227a0071dfb69638dc9f83fdd7d99ea86\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"abb38e7df8d6f08cddb11f57c793dd67cbfaa03e64e7203c1d0a6a9b4782282a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"393f2fdfebf241dcbaa0ae443b32e566084dad1b7c8cf4e6237de95a20ca10df\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"eccb2b7077041a6c5473fcb6f9dd58485e0f96567711421f1cea5cb80bfd0ccc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ab71c1c7c2dccd7c72591861016e3908312803953aee1a08f892ce78b33659fa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2458c735ddded8f7ebd5cdf1cfa73d33af85f1b4f5afa47ef1a360353df8c13e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a00bce455a8ba0c28f513d2cbb3426dff48ac572de4a180ceb56690724d00b35\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f93480a53e523b496c9412cfc58e7f75d121f2d651ea3172486dd7ddcc2ebf35\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4088f3063b27f9d26c95d8b4cc13218e60e59c7f63fece214340d3f0068f6909\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e8b2d8d9ec8f38b9b28942d9c36865b0222b1ca9d82d0f0809e2edc99917ff2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a736aff22b9f2c7af9549b13acf51819f8e99aa04b373d0fb5fbfff688b50cd2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"15900836e6f269b428a7ba51ef7d8dc0a7ca36c301a71f45a53f5f1c4a79ba0b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6cf8ff0bc2509d8cdb34100efac4ca00ad38423a4de09b25ae7f459379466a87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1a6fa01f3aa9c2d26611604900e9a0441bd093c5e19a824325c7f168cb47b11c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"36cb6cbb20273aad26612a19dd5f6c3efe2c9dd2c600f17ad0a915ef88d8b954\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"63b15ec160e5c3f65f606ccd476d6758762dc51865d27e9f2dc6d6ed47ec9551\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0ce7632c4354c0c227fddad698833ef251d10cefef7f25005691c0fadd7534b1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9e544a6ff3c5e4acbe799f06b93f4543c4988fff030e587768dfe9defb00adb0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3e115bb8bf2d55d71e7f9990370dc806ef02b0c5eb99439f32e357c379411367\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a065802be295503b7704c19b0b67b8359647e2add0f49d96146ed9826862d379\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a13d202396b9f03f9e7deb7b13b75b922053e1590d404210385aecaf73a5ca5f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cf188fd4e6d9497fe145323333d65c5de891abbe18df379b2c386769a6533c6f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d6490111a2bd671f3cc91af93da068c37ea6368b20512943eff2ebfeb9e7d117\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b7e6f5a5af1e174b1ee883237807902e5e8d83f39a3be55b585d44cdbecff572\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4ad3ddfc2a3be8b29229c40c95a4b848a9ba651d362feb03479f7b823e10f545\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"539d95d0b5c7e895aefe94233065bd18082830b3fea6a9277ca55a0da71340b3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8db81c68936ba298f790897b302b150bd12d2eec22154ddf944de0192d7f4b4c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c31eb0b4a50b2c61a2954216dce8a56e9cb3b868cf31d217e6d3d57c4b74fd9e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"09e967c8402e6e306f4b71e6a00f60bd434f2bce2c9d59dff1695d35697dc4dc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6aa87f2820fa15854a304fb36e50d7cee4820128539073fc15bb69753599e132\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3f89ae75a20ba19970a54ccc348cc608ebfca7566239d4f9b158f43febd42e55\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9eada5130b36b41e1e1266aa1092c165e97662a21634ed8ec0460d824bc7e7b9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ae63d00fa381b265866cb1b277633e2a155b94de180c6acefe93b77f7e35e7d3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bd16c47d55fdb5e0ae8240ed986c78707a88611b66b44fae5ab86cb758c215c2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e85025d98da554ebf7c487d2062eb7fa47a1b3d6adb7b480115a5ce4cefb0483\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"836df2ea33f6af85c72799cdb8019385010401c873eb9b12a0e6c749eeb56668\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8c4d0e21c666fd015a2db768ffb20bedac801efe539190c06ca7594e9010af8c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"41b85dccaa8cfcafa7d210e7cd2b1c31420b2b2efdf0b87f46a00d62669b0727\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c92a5de0eff7788429bc28fdec8d86609bf02b5fbedce82308479d1706288bec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0ddfa7441f1dbf1ef599148ed77f7bc3072873b1ec449858709aa517261dff6a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"55e675544ade227ac183e9688220aab677d3e3a4d82332e06ed1f425d673a304\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"573b340bccee4a5264ad13b0495d2a6b1e723bb0fe81a6ea97352001ebc74284\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a149d9912ccbb2cd4dd7e07e1172f90c639e64a98b99b9a1967bc3c9bf5d8205\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"609ddabc6778b868f1f0bc5795c071230a76ff3193b26ff5dfa7be54b1c5a36f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"068abb543fe2d8904c85c4227e66d1127808e1da52374db674dc113c87dc522c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdd84071c7d83946e35acff99c9c5b580e876d0c4866c006f5f02e0a107cdd19\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9ce8c2fa3380caeba39c62cfdb2e02b46776e4eac1f908f418140d9b7b883fe2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3586b85b746666dda45c0149c8b212ef8c2b5c5169e2f39c5d3154b119922636\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a5785a5c9d1c12ba13cd603c475c38ef808a12f3823a420b722dc3d70a23c624\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"929ffee0abc41c7a806ffd074e4cfab69d7dfd28eb926dc373bad2330b28a299\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b457a46f3c297a562935e2446d9043cdc1001219a34f31aa169362f32a741476\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ad0f8be0fcd3482ffc4dcce070db2233c156a97a5caf0ba8f88af3eb9789ca93\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"10edd1ae6c0df8a5a1b0594a6fb7b99897fa2d890c87aa6828ecbf4c438a7e03\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6406218469c6248feb077866776924189ca35825c99557888fce19ff8ad56df6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f0f1429576f1a1be321185e1bd6abb819aea50327fda0269d5612db65c382cfd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"75caeb2fecf39c98a65022db57b8b7402a53d8e3bbbbd1058c2a1344df78adfc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4c7e28c4ea66d3867db6e2053d338fd95c76975fa4ce24e65e7850a19b58e263\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"51885626998fd07a952d2366626fa9c9042a4fcef22103bb3076cdc7d2e1e952\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"96a10edf633153472e430c6c2106fabd9d088950913cb891f8d1131e8e85d5da\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ed976c06c4ca362c858910c3dccd54c51c7d22e06a10186b205bc19289bb4d8f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9fcc31bf477a6a539b09c1dafa0d8c389f6af32511fb4c214235577254b96a22\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"04b63ca6998dad8b1e7eed5109e0fa6e6afcad35fbb0aa65553b2ee5aa7c8240\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3a378a4162f02d06b635ffcd9cd97fb7c9975eac68f0d956efd8c3576a6c096c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"559d1da3a3af0f4a6de89f3ed2ff6387393bc8df7d2069266776fab4a9e58b5d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"82a9c25434b61c4772a1ac29246cbb75b1b553266861c57cdeeb5d939581bbaa\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"268824ed95ae571b569392c28a2f752ebe783a99f1990997fbf3d40d303b735b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"df21e7cfc8f3ee440a1487e95ff0c570ae804b786dd01a0d794bd1f3a9985389\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"78b3f9dfb7975e736779a46c7634f04113fea0c5fea7f904b45d4e20a637b245\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d15c406a43328781f512c3e6de986a018b3122ac39a7a4cbc136e998b2b48492\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"76f0f35cf466cedfbe1e34a2e63b4cdd3526f8da2eb57738bb657765040daf5b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e3eeda6dee0071c64c151bbb71350df5353b1c91473127cebe525b54a04ae2cc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"223d764a35e77651bb2257681287c29021eb09722bfc90c7265d02c5ba32cf5e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f41fcbb289a766d6a29268d2be644d886254d678311240795320efb90fdad5eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8395b1e94560ed62d84241a4f665ffff31837260cc9aea35c39d3c05175e3026\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b42d2ea2a5c62b1cba47bae62d396ed1c6451087f098340f79cc1ed15366e415\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"12ea3d26783f57b1d94da52ab6a5901ce98ed4b15dec468549f4012dafa05a23\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"daeca0bfe6a614d446a745f7a44cc67f378c849fbedaa1026e4914166e275650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7fb3347fe6c52798901732dc2685b483e2f0c905d248d89deecc83d92553d1c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1cc8f595efea76e0d3eedd32969d77ea8835ab68928410c6c8b033bf46f72923\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d980c3fc378b4f381adb615552ff0fc69397031c7df24757a73c4edf99162fc0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0adc57d51b35181d57ce7070149cb9dcb5a1c35659398baa1c2c66f130cf379f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a8939b3047ea77ce4de1421d66edd7fbcabaf6b680b0966fae12c9f2b8db7f47\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1ae748d971f49d47d371205b68e94c4d734abb4b723a86bcb07504627759dc89\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1736265c5ca3ff6ef8615dbb050d5afa5d5f07e06104e6e51bb14c17e58043e6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"23aab9fbc666b3e1b9b9e93c16a3f2a3603bc75c70d345208c83efb52c885c12\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"daebbb1a2f4340f3d13a56b86dc4092ce39c6919fdc16213b9251d005dc65bb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"30449cf39f411e1cc4fa580c9f841e231a5d83f9d8c88b5c2dab8b705d0f2b52\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2d5c153474ffbe61aefeb835638d7c68a30f6a8885318889cc87590a7f453a0a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1031e5fe412033da350814ac517fe44eb0eae32dbb531ffb2414912a07a0c15f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9c50fa0064a87ebd762cb4ac0b4dc0e17c2eea32530860448d0a09c94b7e47cf\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eceaa3373eca8aa1fa797e413753c17981f4395ea7c9e6478abf3dbb81e8216b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"741d1c871aa8bc86392a31b6ba5abccc2350355d6463723ec4a6627598f3ddf9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cdf3e72f09d9c23ed7de62e42d53e35a45b58ea6979b92283ba6e44040223a64\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c315208fda098a36b225a63347f5fd4c7ec4c6a07535d21d4963c136d75dda8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f1891bb22a9e5664f3026841b58d9ab6c8ff3d4c1597f502e3c8daf82fd67c78\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b3baf3122d7f4fb81c398e67dce1c007a39d77c1b944b2eb6d102ea948b9366e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2906b56422a5d1e18029f8dfe9f583868b1f6413dbb86a0e4489258e2491aee2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea79ff6eb5f370812a6f750d2a475542d4729e79ab7de6f1e3b51b10c9ff15f4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"53525895e62d7603774165b95492f86a299a94e811b8bfa096068557dc3b7079\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0aabe65457a62852cbc3f5efd4c9afd908cc365b81ff4ccff45d69457999be4f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8efe4c813ac88cde94cfd4bea026c778ccd1fc314df55d6fc5a83b02e37d153e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a5e8be6e6efa0995666cde2b04ee89d684553a2c184ce9d65be941363760f6aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a8c66d50ffdf82d6ecae69a1c0971f324d61cb035754e672c09e1374920c130f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3a98a433d7e13f7037d129fb607c0aa6be8e2786ab529798075891f1caa2e2a6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9aa33d1f7ee5b6f87dfab107560c9553ff008f5f640805b76152726175c3c7a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ef747846c68074cb6f3e6a721fe746c946c0fd87b764ad0f32c0db14a530760c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"105f27cff377e7455202b357006b2ff9c435dd06d077a77766a438b920e65ecb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6ea9e47cbae52d5f98c27737783d0dc37f05ed89537af90900d99ba724786368\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b53dd5318f075895d6819e8d4ceffc9d62fa37419025365efad5d4c37c032ae2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a4fbcc35d3dd061cbfe1038d04f72a085a63f22e6e41e51732d576dcf511ae51\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"774123679310f86a6cee928712e1340beda60d2cfd92fbbd2c0879a79005ee42\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c845c4a191326e7c9ecf6da0b052a10671217a1380a0016bca9315386f48ca03\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dde723c1559b7f93ce7e2cffbcf1cf349ad8c296646082c81a7499be56862cd1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9d8f49969e71ac351537bf21d0ed0bc0dc5eb1695291c30737b293be5df9682f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"22b1883b4b523fcb5aa2347e32fc0852b420c0da88d30eb8ccec885b0647939d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9dc5ba2a85da2966998ed0d77f55d9da2820d7f5d7306991557614037e39a0cc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3a4b1c0e3136e893a0ff6adebc7676449cb25c1230b5628462c88499dc931fae\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c7c1445e34f1134341c70b2411f384cfef83a00287915d9a085d8ab6d61f0f5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c2af1523299b2ae906db2cfc1bc1eca9f96ff5bcf739238555d11eab67499efe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bd6ed37fff73ea134b5c2e7eef124891ca252106484efbdc80756cc354e3ea56\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"750010eae93e29ff523a99ba4e5ef57554664f3213920e75c1959e2db0176128\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7aac3b22be2aee4090a6d0cb32dd002d0fad5a689857d4e92ee03a950b30e0c9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"74883f5b7e7a852327e008c7e9f03a1d91f98325beeb19c446f62796e6aef8d1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4d1ea02979cfe39c600e55838846c4eee4ddc92bb7fcfb3453cd070bcf3e2959\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"44fc74b91f49727f317f3fdebe4dddd5445c63c7601b59dbb817a847a2a1b2eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a982cae2c9190837d5ea04d6ba343f2ddc2a96065c397c50678676b3e6e6c245\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8bf7acafa93e755f68cfd59460e5a54df9f18ca04f2d003d86d0083de64598fe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6200b66035d445a0e4c1702bf2414c2e8877c2f2c473277de2bc9f6e9bf2fe8e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"035ae7b4aacac45527bf36277a7aad77aa4acceba99af38797fa4f951905ee54\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"34cdd18da494efc76065ea82ac3395638e9aca5c40abbd53c0f4538612f07d35\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w1-7a590a"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w1-7a590a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:17.360Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w4-53dcb1-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w4-53dcb1-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:17.443Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w1-7a590a-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w1-7a590a-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:17.452Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-53dcb1","namespace":"e2e-models-e2e-worker-w4-53dcb1","uid":"1092f88c-7f1b-4d74-9ba7-b9b0fd959b68","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-53dcb1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:17.503Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-7a590a","namespace":"e2e-models-e2e-worker-w1-7a590a","uid":"f9af62f3-67ad-4018-8e68-d1b98a22aebf","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-7a590a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:17.504Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-10-30T13:10:17.504Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-10-30T13:10:17.604Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"scheduling retry for non-blocking errors","errorCount":6,"requeueAfter":4}
{"level":"info","ts":"2026-10-30T13:10:19.343Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","EnvoyFilter","Gateway","ConfigMap","HTTPRoute"],"eventTypes":{"delete":3,"update":17}}
{"level":"info","ts":"2026-10-30T13:10:19.405Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-10-30T13:10:19.817Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-10-30T13:10:20.580Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-10-30T13:10:20.582Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-10-30T13:10:20.582Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-10-30T13:10:20.583Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-10-30T13:10:20.586Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-10-30T13:10:20.586Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-10-30T13:10:20.587Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-10-30T13:10:21.605Z","logger":"kuadrant-operator.KuadrantController","msg":"triggering reconciliation retry for non-blocking errors","errorCount":6}
{"level":"error","ts":"2026-10-30T13:10:21.999Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T12:42:13Z","generation":32,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"13037da2-7ce3-408f-991b-ad31db53d1ff\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:44:45Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"13037da2-7ce3-408f-991b-ad31db53d1ff"}],"resourceVersion":"18597","uid":"044e9012-9183-4278-aac0-7fa080f81471"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"etcdserver: request is too large"}
{"level":"error","ts":"2026-10-30T13:10:24.955Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-53dcb1","namespace":"e2e-models-e2e-worker-w4-53dcb1","uid":"1092f88c-7f1b-4d74-9ba7-b9b0fd959b68","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-53dcb1\" not found"}
{"level":"error","ts":"2026-10-30T13:10:24.993Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-7a590a","namespace":"e2e-models-e2e-worker-w1-7a590a","uid":"f9af62f3-67ad-4018-8e68-d1b98a22aebf","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-7a590a\" not found"}
{"level":"error","ts":"2026-10-30T13:10:25.008Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-7a590a","namespace":"e2e-models-e2e-worker-w1-7a590a","uid":"22506f20-f506-4553-8ba6-858d31792325","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-7a590a\" not found"}
{"level":"error","ts":"2026-10-30T13:10:25.042Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-53dcb1","namespace":"e2e-models-e2e-worker-w4-53dcb1","uid":"c38bfaf5-f2e6-48ca-82c3-93e2f72b5b36","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-53dcb1\" not found"}
{"level":"info","ts":"2026-10-30T13:10:25.082Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-10-30T13:10:25.082Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-10-30T13:10:25.181Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"EnvoyFilter.networking.istio.io/openshift-ingress/kuadrant-e2e-worker-w4-53dcb1/update","attempts":3,"duration":13.809732786}
{"level":"info","ts":"2026-10-30T13:10:25.181Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"Limitador.limitador.kuadrant.io/kuadrant-system/limitador/update","attempts":3,"duration":13.80980088}
{"level":"info","ts":"2026-10-30T13:10:25.181Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthPolicy.kuadrant.io/openshift-ingress/e2e-worker-w1-7a590a-maas-auth/update","attempts":2,"duration":10.510464073}
{"level":"info","ts":"2026-10-30T13:10:25.181Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthPolicy.kuadrant.io/openshift-ingress/e2e-worker-w4-53dcb1-maas-auth/update","attempts":2,"duration":10.510440702}
{"level":"info","ts":"2026-10-30T13:10:25.181Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"EnvoyFilter.networking.istio.io/openshift-ingress/kuadrant-e2e-worker-w1-7a590a/update","attempts":3,"duration":13.809765617}
{"level":"info","ts":"2026-10-30T13:10:25.181Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"scheduling retry for non-blocking errors","errorCount":1,"requeueAfter":16}
{"level":"info","ts":"2026-10-30T13:10:25.240Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","Kuadrant","TokenRateLimitPolicy","HTTPRoute","AuthPolicy","Gateway","EnvoyFilter","ConfigMap","Limitador"],"eventTypes":{"create":26,"delete":31,"update":125}}
{"level":"info","ts":"2026-10-30T13:10:25.279Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-10-30T13:10:25.300Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-10-30T13:10:25.895Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-10-30T13:10:25.915Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-10-30T13:10:25.981Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-10-30T13:10:25.981Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-10-30T13:10:26.071Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-10-30T13:10:26.910Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-10-30T13:10:26.912Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-10-30T13:10:26.912Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-10-30T13:10:26.912Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-10-30T13:10:26.915Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-10-30T13:10:26.915Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-10-30T13:10:26.919Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-10-30T13:10:26.931Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-10-30T12:47:43Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:48:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:48:41Z"}],"name":"81e7bc6ff15c5fcf552436509b25c7dfb574a74e08c2e48ee54b9755f92fa90a","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"29975","uid":"c7e304ed-704d-4848-931e-82f0f8bb23d9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["81e7bc6ff15c5fcf552436509b25c7dfb574a74e08c2e48ee54b9755f92fa90a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:48:41Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:48:41Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["81e7bc6ff15c5fcf552436509b25c7dfb574a74e08c2e48ee54b9755f92fa90a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"81e7bc6ff15c5fcf552436509b25c7dfb574a74e08c2e48ee54b9755f92fa90a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:26.972Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-10-30T12:50:59Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:50:59Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:51:06Z"}],"name":"8bf7acafa93e755f68cfd59460e5a54df9f18ca04f2d003d86d0083de64598fe","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"35939","uid":"a5a08f4e-da4e-49ac-b799-54d40a417927"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8bf7acafa93e755f68cfd59460e5a54df9f18ca04f2d003d86d0083de64598fe"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:51:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:51:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8bf7acafa93e755f68cfd59460e5a54df9f18ca04f2d003d86d0083de64598fe"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8bf7acafa93e755f68cfd59460e5a54df9f18ca04f2d003d86d0083de64598fe\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:26.992Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-10-30T12:47:43Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:48:42Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:48:42Z"}],"name":"eab745772fec776a6f0c7c817900ac89dcc6e3a8917a2bfb414cfb44d3d67989","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"30095","uid":"f784471a-a86a-4b20-9e03-b8414deee345"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["eab745772fec776a6f0c7c817900ac89dcc6e3a8917a2bfb414cfb44d3d67989"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:47:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:47:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["eab745772fec776a6f0c7c817900ac89dcc6e3a8917a2bfb414cfb44d3d67989"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"eab745772fec776a6f0c7c817900ac89dcc6e3a8917a2bfb414cfb44d3d67989\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:27.012Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-10-30T12:47:51Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:49:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:49:17Z"}],"name":"a5785a5c9d1c12ba13cd603c475c38ef808a12f3823a420b722dc3d70a23c624","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"31527","uid":"9948bdc2-ba1f-4a1d-ba1b-feb75d9ec1be"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a5785a5c9d1c12ba13cd603c475c38ef808a12f3823a420b722dc3d70a23c624"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:47:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:47:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a5785a5c9d1c12ba13cd603c475c38ef808a12f3823a420b722dc3d70a23c624"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a5785a5c9d1c12ba13cd603c475c38ef808a12f3823a420b722dc3d70a23c624\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:27.032Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-10-30T12:50:58Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:50:58Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:50:59Z"}],"name":"b53dd5318f075895d6819e8d4ceffc9d62fa37419025365efad5d4c37c032ae2","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"35526","uid":"e62760e5-782b-490d-b8f2-586363faa8d3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b53dd5318f075895d6819e8d4ceffc9d62fa37419025365efad5d4c37c032ae2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:50:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:50:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b53dd5318f075895d6819e8d4ceffc9d62fa37419025365efad5d4c37c032ae2"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b53dd5318f075895d6819e8d4ceffc9d62fa37419025365efad5d4c37c032ae2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:27.072Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-10-30T12:53:56Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:53:56Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:53:56Z"}],"name":"15ff23dabc113f8de56339b254a90e582a84646a03e6621c05d53289f469023b","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"42386","uid":"5f18cf3f-fd9b-4b81-9af7-83fc756bbe1d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["15ff23dabc113f8de56339b254a90e582a84646a03e6621c05d53289f469023b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:53:56Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:53:56Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["15ff23dabc113f8de56339b254a90e582a84646a03e6621c05d53289f469023b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"15ff23dabc113f8de56339b254a90e582a84646a03e6621c05d53289f469023b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:27.092Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-10-30T12:51:57Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:51:57Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:51:58Z"}],"name":"10edd1ae6c0df8a5a1b0594a6fb7b99897fa2d890c87aa6828ecbf4c438a7e03","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"37817","uid":"15e7572d-3037-4e3f-9feb-696d31aaec41"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["10edd1ae6c0df8a5a1b0594a6fb7b99897fa2d890c87aa6828ecbf4c438a7e03"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:51:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:51:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["10edd1ae6c0df8a5a1b0594a6fb7b99897fa2d890c87aa6828ecbf4c438a7e03"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"10edd1ae6c0df8a5a1b0594a6fb7b99897fa2d890c87aa6828ecbf4c438a7e03\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:27.112Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route#v1-model-routing"},"creationTimestamp":"2026-10-30T12:47:43Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:48:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:48:41Z"}],"name":"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"30040","uid":"2d495607-a550-4dd9-99e6-c8b0d2688def"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:47:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:47:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:27.133Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-10-30T12:48:29Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:49:18Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:49:18Z"}],"name":"c92a5de0eff7788429bc28fdec8d86609bf02b5fbedce82308479d1706288bec","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"31599","uid":"c761a28f-9cd0-4b0e-8404-6b34ce2fa549"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c92a5de0eff7788429bc28fdec8d86609bf02b5fbedce82308479d1706288bec"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:48:30Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:48:30Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c92a5de0eff7788429bc28fdec8d86609bf02b5fbedce82308479d1706288bec"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c92a5de0eff7788429bc28fdec8d86609bf02b5fbedce82308479d1706288bec\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:27.153Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route#v1-completions-path"},"creationTimestamp":"2026-10-30T12:48:21Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:48:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:48:42Z"}],"name":"d23d6b45289810b57bcf4421cc3f6d7a9b00af854de8d617d6f29562dd513117","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"30082","uid":"06481438-f40f-4867-a812-8ea451ffed61"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d23d6b45289810b57bcf4421cc3f6d7a9b00af854de8d617d6f29562dd513117"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:48:42Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:48:42Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d23d6b45289810b57bcf4421cc3f6d7a9b00af854de8d617d6f29562dd513117"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d23d6b45289810b57bcf4421cc3f6d7a9b00af854de8d617d6f29562dd513117\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:27.189Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route#v1-model-routing"},"creationTimestamp":"2026-10-30T12:47:51Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:49:18Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:49:19Z"}],"name":"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"31628","uid":"57487c16-a7ee-4618-826d-a15ed97e83a7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:47:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:47:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:27.208Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route#v1-messages-path"},"creationTimestamp":"2026-10-30T12:50:58Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:50:58Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:50:58Z"}],"name":"8efe4c813ac88cde94cfd4bea026c778ccd1fc314df55d6fc5a83b02e37d153e","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"35474","uid":"9ed497ca-7f1f-44de-aa61-70f0307f3b78"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8efe4c813ac88cde94cfd4bea026c778ccd1fc314df55d6fc5a83b02e37d153e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:50:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:50:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8efe4c813ac88cde94cfd4bea026c778ccd1fc314df55d6fc5a83b02e37d153e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8efe4c813ac88cde94cfd4bea026c778ccd1fc314df55d6fc5a83b02e37d153e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:27.231Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-10-30T12:48:22Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:48:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:48:41Z"}],"name":"13caff03101ec8fb67cc6985c5efbc26b786120381d2d76f2515fdb6fe7706e9","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"30012","uid":"723e9749-3c8a-49d1-8e29-87cbda582ec3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["13caff03101ec8fb67cc6985c5efbc26b786120381d2d76f2515fdb6fe7706e9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:48:23Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:48:23Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["13caff03101ec8fb67cc6985c5efbc26b786120381d2d76f2515fdb6fe7706e9"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"13caff03101ec8fb67cc6985c5efbc26b786120381d2d76f2515fdb6fe7706e9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:27.252Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route#v1-model-routing"},"creationTimestamp":"2026-10-30T12:53:11Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:53:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:53:12Z"}],"name":"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"40557","uid":"d8ca9fa5-75d4-44c7-81eb-48c636869e2e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:53:12Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:53:12Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:27.272Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-10-30T12:51:57Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:51:57Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:51:57Z"}],"name":"ae63d00fa381b265866cb1b277633e2a155b94de180c6acefe93b77f7e35e7d3","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"37766","uid":"b15a43aa-ed34-429f-b08f-37e95283f99d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ae63d00fa381b265866cb1b277633e2a155b94de180c6acefe93b77f7e35e7d3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:51:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:51:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ae63d00fa381b265866cb1b277633e2a155b94de180c6acefe93b77f7e35e7d3"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ae63d00fa381b265866cb1b277633e2a155b94de180c6acefe93b77f7e35e7d3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:27.301Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-10-30T12:53:56Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:53:56Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:53:57Z"}],"name":"2634d60d3fbc322f122dacc07b9e00083342e7efbe03e17bf65457a826752cf4","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"42398","uid":"d7b2e00d-b57e-450d-8194-56c06302d5bd"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2634d60d3fbc322f122dacc07b9e00083342e7efbe03e17bf65457a826752cf4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:53:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:53:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2634d60d3fbc322f122dacc07b9e00083342e7efbe03e17bf65457a826752cf4"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2634d60d3fbc322f122dacc07b9e00083342e7efbe03e17bf65457a826752cf4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:27.323Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route#v1-model-routing"},"creationTimestamp":"2026-10-30T12:50:59Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:50:59Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:51:07Z"}],"name":"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"36004","uid":"fb8f2856-9160-40ed-8f1e-e239920bd1b0"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:51:07Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:51:07Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:27.344Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route#v1-messages-path"},"creationTimestamp":"2026-10-30T12:48:21Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:48:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:48:41Z"}],"name":"50f9f35158468854257f3b1da534aee4a02c5f37c0b91fe1a72899c341660094","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"30053","uid":"94c05581-df7d-428b-a5d9-f727d0919152"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["50f9f35158468854257f3b1da534aee4a02c5f37c0b91fe1a72899c341660094"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:48:41Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:48:41Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["50f9f35158468854257f3b1da534aee4a02c5f37c0b91fe1a72899c341660094"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"50f9f35158468854257f3b1da534aee4a02c5f37c0b91fe1a72899c341660094\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:27.364Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1#rule-5"},"creationTimestamp":"2026-10-30T12:46:57Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:48:42Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:48:42Z"}],"name":"ebf2ac513888626165cd2d0790db586c2e4365bfc263ad07ac289ad50a7f0ae7","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"30090","uid":"63ea8479-5d17-421e-b7fe-8b1c85390cbb"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ebf2ac513888626165cd2d0790db586c2e4365bfc263ad07ac289ad50a7f0ae7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:46:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:46:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ebf2ac513888626165cd2d0790db586c2e4365bfc263ad07ac289ad50a7f0ae7"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ebf2ac513888626165cd2d0790db586c2e4365bfc263ad07ac289ad50a7f0ae7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:27.365Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w4-53dcb1","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T12:46:57Z","generation":47,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"ad19e696-52ed-4450-94f1-eded048bba27\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T13:10:06Z"}],"name":"kuadrant-e2e-worker-w4-53dcb1","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w4-53dcb1","uid":"ad19e696-52ed-4450-94f1-eded048bba27"}],"resourceVersion":"83816","uid":"9ec80002-b898-42ba-8857-784b6380ab66"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"25a1c9993b6f4ea69206eb6b230a0d5e752e689ebff241573f64cb0dcfed87bb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fdd2e931d0bc13263b903b61e1e009643cb3cb9f04728983f0a3ad1f80b17c2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05721040781acc43415365dffa14dcbb8008a73032f9fb4236838ae804f27cd9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7bc4fa4dc4148ac1b4dafbf544ddd9d141620d3c180513f76d642f7f7ec70af7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c5f2c0c7936757ece0bd2bc5d5d0172ca7760238d4a1aa4770798563e686071e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"08e10bd762ef9d277835f71d88a02ff17d9288d457fbc20c34f4c0fa61ace29e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0d0c5ad4cf5daf3340df7ec7bc02c0227878b43cc86f681eb8dceb836c188bac\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"77d288314f0282382ba31d8fff80ddccb1ca29df3066d00f7a2d9fc7cf6b06aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29ab17092352c0529d55cf050576da245a70dd62cec1da7912970150bd59a079\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbe36e82df47f6018446263f2720506e0888dad51ebdbd8a452aa39bab62320a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"de83e7795994116b47a6afcb4c300d56e6212f572909b311eebdae742b22db18\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2fa69e45d07440b1d4349b9a6603a14ca661a5cea439561e12cad2ab34bc3787\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c00658935c443bfc6b50aacecd40e2757e1434283a8ff1433611aebc4bfff347\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"99af2676f76182c413086a97bb31d9c67c509d7197fccbb26a9f72924cb9b153\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"865fe8edccec04f5fb55cdfef525c52c270ff0e4a7669ebd90714b892bc6b5ab\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4929a20f544b7005ce186874f90904640440dbf6bcf27f631412f6d0aaf65ee7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b1dfa4f975f7d58a22d462c662503f31664b7344d77150fc12167f31f05ca0a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"dba194f3dbcac655aebddfa3ea98dd2dd486760005d2ff2e87db3b2b445dd235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5905c63b7a6f8479c2bdf582769cf959048fe65bc9d0292d78dff259df383f54\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ac0b09d88152f12160535805c80002cbfb09c9925933ae43bd5d449357ff396a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"39d0af230c6555e4d3c2ee1dc247c36f417b1cc3502e3bed0a588e095410987f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ffef4b578a566be9626a99782a91b7ef0bea204cabe0bc69c5acd09f6c3673d7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a69418c064056026973af3a090f779fbb3dc3ee106c8054a7822cb4bdba759fb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6da0786f468dfd552ade1b11b8c3bfa854fff0f80cdd4b34fd451d8c50f0cf6d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6c547c2167c9135ebd65453f030b83b6bbbbb0e12fc95c7efa6b55331a01a81c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"520b3c828dbcc36acab6d0c5c97168f2df746cea294b070c48a25e4e9c26b26d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"84fcdcffb035aa4df026ea8b182c1d985c4deb171fb09264f5c2b78a7e290054\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"145d954305506b9fba35d76b2657c538b39d74dbeb078381aea86745b7bd64a7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"663790a0510f2693daf89340f00b57d9cb74a7e630de51e1f4e40f5759072963\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c9af5d5096c5c8e060feb79ccbf8348d2d5d819edf39a5dbafd4bd61c28de2b4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7e2454df0aada7fdd8ccd57fac150f260861e6c3472d5bdceeba2460b533958a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2b6f42efd682e1ea0376780340d0f60cef20eabdc177badf8c8ad46bf67daa6f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4c43f9d5f89223314ff24852e7f60990cdcffd391cae2e1728b63cb0cbd8e575\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b09bb280a4a5caa95494a0190d901dcb323926a950e611ffe112fe41c2586a6b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"46fc87d721087034978051b991603b15a1549a42ffd6a9f2d7540fa624d9fbe0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"07a9fbfd845551af5d7e8ad023ca8fb4bca991962b48191e7b9e7ec9f7c9410a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06644eed28a6354f9d9cbd205635366137e6f9a985e0cdf1f830923dc4c32196\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"68ecb87a9879d271a0377e0c71e8bb13fb86e8b9efb884649b22354c53bc0f98\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6ce786297e806878f759f8ebe30957c2bd515f34c8cd580c47396d68b73ee3d1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4806fdc003ab234e5613ac5978afcbb90ad7ee95e124d8b8b68bd3ae14a6a4dd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6ef9659353658fa30f8a50bb13e2e8523254919072f9604a5929a5ceb0a6bc17\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bab2aab3d0a190fbfe76a15bd83bb4d25567457a8ea53642a43efec9950c8eeb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2634d60d3fbc322f122dacc07b9e00083342e7efbe03e17bf65457a826752cf4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5aba94a69f9e6f9f49f506393b4e1f94dcc8c733a154a04211a09d4ccf02889a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eab745772fec776a6f0c7c817900ac89dcc6e3a8917a2bfb414cfb44d3d67989\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d017fd2c0c444c2a18f9ee008dc7cca88e7d3772c4747e4627cd4d1578552705\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"866ba8602385aeaa90e8ae78ada1be9ce63dd09727bf4ecc6c1fa758e828a9bd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"764f95faac255d6894c3b72c3b5d4b3310629e20f3a61e4a24f480cdbb534ccf\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"15ff23dabc113f8de56339b254a90e582a84646a03e6621c05d53289f469023b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f7c94f5addf2a5fafe55d76d5abac3e9e255c9e513b938166b26072dbbe1ff7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"006181ea19644569eba45d273bd8a4fc3b9b2bd4ecbd3ef11fbb23f3a488daba\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a8f18c80abda1bd84eb4ce7401df1b9272f767e6067d1caddc8d7e5560b270c0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8a140385139e5d1094af15ad091323d3ab199555833d87f4aab24de3d072b6e1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f262fc03d8702fd881d8cd47fe5dc53fa2b0caa758bc5f53e1504d4228b89af8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9daf1c7213c63158612c39c6292118e88db3ad9946191083ee2a5a5a42090281\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2d3d2ed379ff94f056ee47d557617cf8e11ef5e053dc91ae59462c063d6bc659\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1e238b7d9e3f5d63d4bb1b2c1e20a3b8446c915d602f4a498ff5e32b26494ce9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"86e5206ca9dda35199b03c7404f14484a0dc9345dc56aa254257dad3fe3045c9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9d94bdb074cd59e0eeb52465f57a2886f3010a3084bca915240c377dfa69371d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"76aef54a15f29a2d7e6a2e90a2bca69a7f7006d2cc855729cfcbe5ed2e20bce6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f09d09fc6dde1d236524d4d6dcb928bdcf139e1b1ce84cce5a5a61d0dfbe9a0d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cbb1929d83c87332ce3ac1c2c7eb219492bfa2b8f14a75142746a20f7533efb3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8013b4888d8c0c89f4fb91ca2c345624f24083cc7b8ea83841c85560e17fd789\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"800ccb9059fb2669e3e7f64e2570052f23cc34e2c5c2df30ea9c882f6a6563a5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"848ef614bc7f06bf3e510719cdaccc63c032f4baa9511a3271180a15243597be\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7538aa8fb0f19ce73bd49b0cf2cc2529f3177a4e22fd00f296706e6193c57c62\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b7fd9eb41424bdbacdb2d2be398f7f3d33ee8577e46641724bb6c847f8a39b50\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8d5f23b63daf3626d0e9d0e10d1d1a2ffbe77f04a3e9ef732a89194f8231d888\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"81e7bc6ff15c5fcf552436509b25c7dfb574a74e08c2e48ee54b9755f92fa90a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"57d7aec31d434be52f7b457c9fb3411b8bed4ba7dd552ddb9a03f4f751b80ce9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"11d94353721e19c51aa0bc6aaf17a915f0c4bc5c5b03c6670c645da71e67b0ab\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c341acb6cdaf59c82cf61b20358dd3839468045103db5ec5c628531e6da465b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e43587797a9f0e99f41485cc6382657fd275bc0456caa79ddfb81c0a3829ce8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"792380c647e80d86421f854ef1b85a93875b66898601b71c4cf2a2e944e593c0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e9a145d980170d0288208e686227f27cf4330221d68aa965fa696259630442c4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9650a227b189b38fd3967a878a7dad544dfa7c3ff95cfcd0a2a874103408d1c7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05daa6d986fd5a49c2023f2b7516d814e699fceafa44c99344553fea00c14848\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6537b6fcd48e7484cc289a8663ad12d6efb1403bebedd27c74627597b05f748b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"19bfec94f9532ea4b5b1ff4e22e34dccda05f7858053828e2a904551707f45dc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea2123826bcdce0fdce2c5a90727e1dd179d03b031c83f0b813d0ae63eb69677\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b7432eac2809c3393fb8b46df502f39f77e27e5e88eff0e8835bfdb185fa9eef\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8950dc33891bcf7b11610edf1c476c4ad48308a70ee7a0715a4ecc0200f0750c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5e2828e21483a361ca7af9667f8d2d5b6b368fff80e00b61868847aed179c479\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e54452bb832f5639f81eea8108710ae6b8208c72f43891f5d68e3738c7045204\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"104f9b7f51a3df1f9430904dedb3f7a4cf21c6cc4c20557200b5472ed316a34b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9ba0e3c245ec075a8ac59e90542272767b57e107405871ea949b889ee6539e55\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d277167c1aa8cacaa4008b08884917c3bf967bff3e5581e0d555489ad3f97e24\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"36062c03d9e26d06762aa1187aebb222e71f039151b2c623f6b5367983de7d70\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"671fede733c21121c0fa91b5b6cadbeceb86fb48425b13fa2b5f9d78803a82f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"407d064e9fb88cdc3971fe2d6bf8c9b1420f29af1ffc535d11bb7ed27b64ff42\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"282fb13e85739e757462864ee696b3b5e995491369e9a8b047440bf7e1681190\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3b93464ed862579d468647c5a4c3b4bb20cd49b9fbc1508ab9a76bc02c103875\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d23d6b45289810b57bcf4421cc3f6d7a9b00af854de8d617d6f29562dd513117\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8f0952e906a65a8f638e31655c86ef2b14fcb462735baf16d752c564ec3685f0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2a63b0542f7d5e9ab21ff2a70e875d9016c654a34be4af8b2862093443d15c51\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f87733d531f5c5ac690831f7810e82ab2fa83c91261b4620c531b6c1e2597408\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"17173ba26c2e665c9e0e4ef6ffc67fd759e864382b5cbe50edc98a2bdae7ddd4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"26b154581e3881356d524a47c977002fcebf8fc95f12b0fe9e16ff9bc93b6869\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b444fff7c731702df9c43dd18a342ed5f4b84acbd2ae2c04e246e2ddadc11c94\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7dd0d1de5baa211489652a3c15f430b8d98c560c8a2d48d601fecea8ef647fe0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7cd969c2f8771fba44a7e483980f071aa82ff99f59db04390ca78ff143e778c0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1428a708edeea422ef4b9716589806d329bf8845f820bfe5bc7178813f441d85\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"076a038410428b9ac2bad029581c01b28cffd7b7f1a64c56465ca488c625b3c5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4c02356413d5b89c13f5a61a96468b87adeed2b50bd1a06310c89906490d0ef4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"50f9f35158468854257f3b1da534aee4a02c5f37c0b91fe1a72899c341660094\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7b9be35bff6fdec58573ed2c1a1152fcbea438cef2475fc4cc9c903209a01c16\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4917cb32e7b2094a58f1559c0d805212c1f0a354154ff0d6718a8463e5565d99\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5504d0ebc213428e8e60ba1b109351cf7131650f3094706e423b22777e0a6a2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c2d72b7f90bb96f33e2e1b00416be5fdbcedf88bc9b8577dd76935f6319a4e60\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"595ee786cd23b52cf9e2dc51a3ee8f43ca72d2ecc929144b3271d8f106843faa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce47c00ef51de8c42dff484190186d5315e9812635a34ef8cbec474b4571879a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a75be581b7a86b2a2c0f39b442e1fa507ea04ff01e418ef580566cfbccf215d7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5b7b766a72874acf9e8163ee483bc3d2370257bc288a07afd179471595fc5c6d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b205f794a68f488c4a8f87b688181870575e9b6ca3b2a00df6f22524886338aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce573b3027ad9607006464b4e16f49dcac328bda3098dc2f9cbf0de48aa9d1a3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1c971719638c32dc812964dd616c6226115934f0909c7b85ed98644b854b3cb5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ebf2ac513888626165cd2d0790db586c2e4365bfc263ad07ac289ad50a7f0ae7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"489c62d558d8722de6ee3dcfd2c48a08927d2cdbf9949a248345c4f615f73f62\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9a0f225cd047dcdb3f4867b212ef3e6dec20d7e8a4fca7af06293fb5c507b2a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"91af9bbd342d70e7ded90a99ca79e9232c49add440a0baa7506ff0f8fcb7b531\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4f9ad3ea2cb0afdd240e7a999cacd6f99c830a43e8d5ae688123da58c428bec2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96425c7ab5b8711bc556881ccc5c39b9c0666aa833805063b33ba887d4a5a819\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8c0cd107e1fa6f004c9af05b8c3102f19ebfd173ca67bf6c06fdd17256eaba05\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0d3bea7d8f4148509a7b4fdd379c391351993a4406d93efebab9d2e3a0fb2cb6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"054858abf03d49266e8b2b24aacaec6285f09f0adfa2239155a173261bdcca7c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cedd6fd6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"5e10f090432411a7\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cedd6fd6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-simulator-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3df8116a7d69f8b78dff00107df12558b13101576f05fa1c19384020dc817adf\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/simulator-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"13caff03101ec8fb67cc6985c5efbc26b786120381d2d76f2515fdb6fe7706e9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__24c2eb63\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"aacf9fd56ac50f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__24c2eb63 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-53dcb1/maas-trlp-premium-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"62b30c6ad3a9fcfa5ee595e3c4ec2739df9ba145321ad1f24428f133ada2d563\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/premium-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d698cb3490c21dc5d10c6de9a6bc389ce436a75532ce382d151ae459332e57ee\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f8ea478a97a900e8d13e31f88e44d56eb6952feee907f3e774a95b8e3de26382\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-w4-53dcb1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3ae6be995c08f6214b9af6f7ee2efd55d8f0b2fb8b2e04829e5955c670b7b74d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-53dcb1-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__ae18e214\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__ae18e214 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-53dcb1\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"264d2df2ea589600cf328e148b762248ac5130839cf3859470c36a43292ff4b1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w4-53dcb1/models/e2e/distinct-2-w4-53dcb1\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w4-53dcb1"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w4-53dcb1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:27.384Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1#rule-3"},"creationTimestamp":"2026-10-30T12:46:57Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:48:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:48:42Z"}],"name":"9a0f225cd047dcdb3f4867b212ef3e6dec20d7e8a4fca7af06293fb5c507b2a9","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"30065","uid":"e41bdf82-3a91-47da-92b4-cef7020e3928"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9a0f225cd047dcdb3f4867b212ef3e6dec20d7e8a4fca7af06293fb5c507b2a9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:46:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:46:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9a0f225cd047dcdb3f4867b212ef3e6dec20d7e8a4fca7af06293fb5c507b2a9"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9a0f225cd047dcdb3f4867b212ef3e6dec20d7e8a4fca7af06293fb5c507b2a9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:27.408Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-10-30T12:51:57Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:51:57Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:52:04Z"}],"name":"55e675544ade227ac183e9688220aab677d3e3a4d82332e06ed1f425d673a304","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"38079","uid":"92aef037-85c6-455b-b615-ee60f79772a9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["55e675544ade227ac183e9688220aab677d3e3a4d82332e06ed1f425d673a304"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:52:04Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:52:04Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["55e675544ade227ac183e9688220aab677d3e3a4d82332e06ed1f425d673a304"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"55e675544ade227ac183e9688220aab677d3e3a4d82332e06ed1f425d673a304\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:27.497Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-10-30T12:53:57Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:53:57Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:53:57Z"}],"name":"4917cb32e7b2094a58f1559c0d805212c1f0a354154ff0d6718a8463e5565d99","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"42409","uid":"666fae5f-0225-49b4-9171-c11e91738276"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4917cb32e7b2094a58f1559c0d805212c1f0a354154ff0d6718a8463e5565d99"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:53:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:53:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4917cb32e7b2094a58f1559c0d805212c1f0a354154ff0d6718a8463e5565d99"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4917cb32e7b2094a58f1559c0d805212c1f0a354154ff0d6718a8463e5565d99\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:27.570Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-10-30T12:50:59Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:50:59Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:51:02Z"}],"name":"daeca0bfe6a614d446a745f7a44cc67f378c849fbedaa1026e4914166e275650","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"35662","uid":"35fcad70-adeb-4d13-bdac-918c82d5b0b4"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["daeca0bfe6a614d446a745f7a44cc67f378c849fbedaa1026e4914166e275650"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:51:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:51:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["daeca0bfe6a614d446a745f7a44cc67f378c849fbedaa1026e4914166e275650"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"daeca0bfe6a614d446a745f7a44cc67f378c849fbedaa1026e4914166e275650\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:27.591Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route#v1-messages-path"},"creationTimestamp":"2026-10-30T12:47:50Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:49:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:49:18Z"}],"name":"f1891bb22a9e5664f3026841b58d9ab6c8ff3d4c1597f502e3c8daf82fd67c78","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"31577","uid":"67e176b6-51c4-48b2-a679-57bdcf8ce684"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f1891bb22a9e5664f3026841b58d9ab6c8ff3d4c1597f502e3c8daf82fd67c78"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:49:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:49:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f1891bb22a9e5664f3026841b58d9ab6c8ff3d4c1597f502e3c8daf82fd67c78"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f1891bb22a9e5664f3026841b58d9ab6c8ff3d4c1597f502e3c8daf82fd67c78\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:27.612Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a#rule-5"},"creationTimestamp":"2026-10-30T12:47:09Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:49:18Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:49:18Z"}],"name":"22b1883b4b523fcb5aa2347e32fc0852b420c0da88d30eb8ccec885b0647939d","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"31579","uid":"7131b1ed-3f98-4d8d-8aec-73652a3e685d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["22b1883b4b523fcb5aa2347e32fc0852b420c0da88d30eb8ccec885b0647939d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:47:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:47:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["22b1883b4b523fcb5aa2347e32fc0852b420c0da88d30eb8ccec885b0647939d"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"22b1883b4b523fcb5aa2347e32fc0852b420c0da88d30eb8ccec885b0647939d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:27.633Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1#rule-6"},"creationTimestamp":"2026-10-30T12:46:56Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:48:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:48:41Z"}],"name":"4c43f9d5f89223314ff24852e7f60990cdcffd391cae2e1728b63cb0cbd8e575","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"30058","uid":"1b142b4a-dab8-48e0-833c-b37d59226d68"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4c43f9d5f89223314ff24852e7f60990cdcffd391cae2e1728b63cb0cbd8e575"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:46:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:46:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4c43f9d5f89223314ff24852e7f60990cdcffd391cae2e1728b63cb0cbd8e575"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4c43f9d5f89223314ff24852e7f60990cdcffd391cae2e1728b63cb0cbd8e575\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:27.654Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route#v1-responses-path"},"creationTimestamp":"2026-10-30T12:47:43Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:48:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:48:41Z"}],"name":"282fb13e85739e757462864ee696b3b5e995491369e9a8b047440bf7e1681190","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"30055","uid":"eb8370d7-dc77-4d9d-b10e-7f6579e3abfb"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["282fb13e85739e757462864ee696b3b5e995491369e9a8b047440bf7e1681190"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:47:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:47:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["282fb13e85739e757462864ee696b3b5e995491369e9a8b047440bf7e1681190"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"282fb13e85739e757462864ee696b3b5e995491369e9a8b047440bf7e1681190\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:27.689Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-10-30T12:48:30Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:49:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:49:17Z"}],"name":"b42d2ea2a5c62b1cba47bae62d396ed1c6451087f098340f79cc1ed15366e415","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"31492","uid":"ad9c6b9e-d6d1-471d-959c-fd2b2ae62bdd"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b42d2ea2a5c62b1cba47bae62d396ed1c6451087f098340f79cc1ed15366e415"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:49:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:49:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b42d2ea2a5c62b1cba47bae62d396ed1c6451087f098340f79cc1ed15366e415"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b42d2ea2a5c62b1cba47bae62d396ed1c6451087f098340f79cc1ed15366e415\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:27.710Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-10-30T12:47:43Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:48:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:48:42Z"}],"name":"06644eed28a6354f9d9cbd205635366137e6f9a985e0cdf1f830923dc4c32196","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"30069","uid":"95230a61-52e0-460c-bd0e-de9aab351557"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["06644eed28a6354f9d9cbd205635366137e6f9a985e0cdf1f830923dc4c32196"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:47:44Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:47:44Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["06644eed28a6354f9d9cbd205635366137e6f9a985e0cdf1f830923dc4c32196"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"06644eed28a6354f9d9cbd205635366137e6f9a985e0cdf1f830923dc4c32196\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:27.730Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-10-30T12:47:51Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:49:18Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:49:20Z"}],"name":"74883f5b7e7a852327e008c7e9f03a1d91f98325beeb19c446f62796e6aef8d1","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"31650","uid":"ff590119-71f9-49cc-86af-caeced134b00"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["74883f5b7e7a852327e008c7e9f03a1d91f98325beeb19c446f62796e6aef8d1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:47:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:47:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["74883f5b7e7a852327e008c7e9f03a1d91f98325beeb19c446f62796e6aef8d1"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"74883f5b7e7a852327e008c7e9f03a1d91f98325beeb19c446f62796e6aef8d1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:27.754Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w1-7a590a","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T12:47:09Z","generation":43,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"59691ce6-45f9-466f-95b0-37ea51621f91\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T13:10:06Z"}],"name":"kuadrant-e2e-worker-w1-7a590a","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w1-7a590a","uid":"59691ce6-45f9-466f-95b0-37ea51621f91"}],"resourceVersion":"83768","uid":"bd8113b0-02c2-4ef6-ac7b-70f5da056591"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"089b88945c3f987cbd854645d335b1ed3f87d04e17e66f7e7d584e52c1c5293b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"782eb2b86655a7063ec50aeb50761ba028d5aff1c427b9c596182c02806eaa12\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2e367576ea8266051677e41fdcbf708227a0071dfb69638dc9f83fdd7d99ea86\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"abb38e7df8d6f08cddb11f57c793dd67cbfaa03e64e7203c1d0a6a9b4782282a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"393f2fdfebf241dcbaa0ae443b32e566084dad1b7c8cf4e6237de95a20ca10df\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"eccb2b7077041a6c5473fcb6f9dd58485e0f96567711421f1cea5cb80bfd0ccc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ab71c1c7c2dccd7c72591861016e3908312803953aee1a08f892ce78b33659fa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2458c735ddded8f7ebd5cdf1cfa73d33af85f1b4f5afa47ef1a360353df8c13e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a00bce455a8ba0c28f513d2cbb3426dff48ac572de4a180ceb56690724d00b35\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f93480a53e523b496c9412cfc58e7f75d121f2d651ea3172486dd7ddcc2ebf35\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4088f3063b27f9d26c95d8b4cc13218e60e59c7f63fece214340d3f0068f6909\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e8b2d8d9ec8f38b9b28942d9c36865b0222b1ca9d82d0f0809e2edc99917ff2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a736aff22b9f2c7af9549b13acf51819f8e99aa04b373d0fb5fbfff688b50cd2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"15900836e6f269b428a7ba51ef7d8dc0a7ca36c301a71f45a53f5f1c4a79ba0b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6cf8ff0bc2509d8cdb34100efac4ca00ad38423a4de09b25ae7f459379466a87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1a6fa01f3aa9c2d26611604900e9a0441bd093c5e19a824325c7f168cb47b11c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"36cb6cbb20273aad26612a19dd5f6c3efe2c9dd2c600f17ad0a915ef88d8b954\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"63b15ec160e5c3f65f606ccd476d6758762dc51865d27e9f2dc6d6ed47ec9551\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0ce7632c4354c0c227fddad698833ef251d10cefef7f25005691c0fadd7534b1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9e544a6ff3c5e4acbe799f06b93f4543c4988fff030e587768dfe9defb00adb0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3e115bb8bf2d55d71e7f9990370dc806ef02b0c5eb99439f32e357c379411367\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a065802be295503b7704c19b0b67b8359647e2add0f49d96146ed9826862d379\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a13d202396b9f03f9e7deb7b13b75b922053e1590d404210385aecaf73a5ca5f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cf188fd4e6d9497fe145323333d65c5de891abbe18df379b2c386769a6533c6f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d6490111a2bd671f3cc91af93da068c37ea6368b20512943eff2ebfeb9e7d117\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b7e6f5a5af1e174b1ee883237807902e5e8d83f39a3be55b585d44cdbecff572\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4ad3ddfc2a3be8b29229c40c95a4b848a9ba651d362feb03479f7b823e10f545\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"539d95d0b5c7e895aefe94233065bd18082830b3fea6a9277ca55a0da71340b3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8db81c68936ba298f790897b302b150bd12d2eec22154ddf944de0192d7f4b4c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c31eb0b4a50b2c61a2954216dce8a56e9cb3b868cf31d217e6d3d57c4b74fd9e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"09e967c8402e6e306f4b71e6a00f60bd434f2bce2c9d59dff1695d35697dc4dc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6aa87f2820fa15854a304fb36e50d7cee4820128539073fc15bb69753599e132\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3f89ae75a20ba19970a54ccc348cc608ebfca7566239d4f9b158f43febd42e55\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9eada5130b36b41e1e1266aa1092c165e97662a21634ed8ec0460d824bc7e7b9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ae63d00fa381b265866cb1b277633e2a155b94de180c6acefe93b77f7e35e7d3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bd16c47d55fdb5e0ae8240ed986c78707a88611b66b44fae5ab86cb758c215c2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e85025d98da554ebf7c487d2062eb7fa47a1b3d6adb7b480115a5ce4cefb0483\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"836df2ea33f6af85c72799cdb8019385010401c873eb9b12a0e6c749eeb56668\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8c4d0e21c666fd015a2db768ffb20bedac801efe539190c06ca7594e9010af8c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"41b85dccaa8cfcafa7d210e7cd2b1c31420b2b2efdf0b87f46a00d62669b0727\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c92a5de0eff7788429bc28fdec8d86609bf02b5fbedce82308479d1706288bec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0ddfa7441f1dbf1ef599148ed77f7bc3072873b1ec449858709aa517261dff6a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"55e675544ade227ac183e9688220aab677d3e3a4d82332e06ed1f425d673a304\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"573b340bccee4a5264ad13b0495d2a6b1e723bb0fe81a6ea97352001ebc74284\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a149d9912ccbb2cd4dd7e07e1172f90c639e64a98b99b9a1967bc3c9bf5d8205\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"609ddabc6778b868f1f0bc5795c071230a76ff3193b26ff5dfa7be54b1c5a36f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"068abb543fe2d8904c85c4227e66d1127808e1da52374db674dc113c87dc522c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdd84071c7d83946e35acff99c9c5b580e876d0c4866c006f5f02e0a107cdd19\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9ce8c2fa3380caeba39c62cfdb2e02b46776e4eac1f908f418140d9b7b883fe2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3586b85b746666dda45c0149c8b212ef8c2b5c5169e2f39c5d3154b119922636\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a5785a5c9d1c12ba13cd603c475c38ef808a12f3823a420b722dc3d70a23c624\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"929ffee0abc41c7a806ffd074e4cfab69d7dfd28eb926dc373bad2330b28a299\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b457a46f3c297a562935e2446d9043cdc1001219a34f31aa169362f32a741476\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ad0f8be0fcd3482ffc4dcce070db2233c156a97a5caf0ba8f88af3eb9789ca93\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"10edd1ae6c0df8a5a1b0594a6fb7b99897fa2d890c87aa6828ecbf4c438a7e03\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6406218469c6248feb077866776924189ca35825c99557888fce19ff8ad56df6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f0f1429576f1a1be321185e1bd6abb819aea50327fda0269d5612db65c382cfd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"75caeb2fecf39c98a65022db57b8b7402a53d8e3bbbbd1058c2a1344df78adfc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4c7e28c4ea66d3867db6e2053d338fd95c76975fa4ce24e65e7850a19b58e263\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"51885626998fd07a952d2366626fa9c9042a4fcef22103bb3076cdc7d2e1e952\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"96a10edf633153472e430c6c2106fabd9d088950913cb891f8d1131e8e85d5da\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ed976c06c4ca362c858910c3dccd54c51c7d22e06a10186b205bc19289bb4d8f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9fcc31bf477a6a539b09c1dafa0d8c389f6af32511fb4c214235577254b96a22\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"04b63ca6998dad8b1e7eed5109e0fa6e6afcad35fbb0aa65553b2ee5aa7c8240\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3a378a4162f02d06b635ffcd9cd97fb7c9975eac68f0d956efd8c3576a6c096c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"559d1da3a3af0f4a6de89f3ed2ff6387393bc8df7d2069266776fab4a9e58b5d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"82a9c25434b61c4772a1ac29246cbb75b1b553266861c57cdeeb5d939581bbaa\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"268824ed95ae571b569392c28a2f752ebe783a99f1990997fbf3d40d303b735b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"df21e7cfc8f3ee440a1487e95ff0c570ae804b786dd01a0d794bd1f3a9985389\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"78b3f9dfb7975e736779a46c7634f04113fea0c5fea7f904b45d4e20a637b245\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d15c406a43328781f512c3e6de986a018b3122ac39a7a4cbc136e998b2b48492\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"76f0f35cf466cedfbe1e34a2e63b4cdd3526f8da2eb57738bb657765040daf5b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e3eeda6dee0071c64c151bbb71350df5353b1c91473127cebe525b54a04ae2cc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"223d764a35e77651bb2257681287c29021eb09722bfc90c7265d02c5ba32cf5e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f41fcbb289a766d6a29268d2be644d886254d678311240795320efb90fdad5eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8395b1e94560ed62d84241a4f665ffff31837260cc9aea35c39d3c05175e3026\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b42d2ea2a5c62b1cba47bae62d396ed1c6451087f098340f79cc1ed15366e415\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"12ea3d26783f57b1d94da52ab6a5901ce98ed4b15dec468549f4012dafa05a23\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"daeca0bfe6a614d446a745f7a44cc67f378c849fbedaa1026e4914166e275650\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7fb3347fe6c52798901732dc2685b483e2f0c905d248d89deecc83d92553d1c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1cc8f595efea76e0d3eedd32969d77ea8835ab68928410c6c8b033bf46f72923\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d980c3fc378b4f381adb615552ff0fc69397031c7df24757a73c4edf99162fc0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0adc57d51b35181d57ce7070149cb9dcb5a1c35659398baa1c2c66f130cf379f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a8939b3047ea77ce4de1421d66edd7fbcabaf6b680b0966fae12c9f2b8db7f47\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1ae748d971f49d47d371205b68e94c4d734abb4b723a86bcb07504627759dc89\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1736265c5ca3ff6ef8615dbb050d5afa5d5f07e06104e6e51bb14c17e58043e6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"23aab9fbc666b3e1b9b9e93c16a3f2a3603bc75c70d345208c83efb52c885c12\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"daebbb1a2f4340f3d13a56b86dc4092ce39c6919fdc16213b9251d005dc65bb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"30449cf39f411e1cc4fa580c9f841e231a5d83f9d8c88b5c2dab8b705d0f2b52\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2d5c153474ffbe61aefeb835638d7c68a30f6a8885318889cc87590a7f453a0a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1031e5fe412033da350814ac517fe44eb0eae32dbb531ffb2414912a07a0c15f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9c50fa0064a87ebd762cb4ac0b4dc0e17c2eea32530860448d0a09c94b7e47cf\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eceaa3373eca8aa1fa797e413753c17981f4395ea7c9e6478abf3dbb81e8216b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"741d1c871aa8bc86392a31b6ba5abccc2350355d6463723ec4a6627598f3ddf9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cdf3e72f09d9c23ed7de62e42d53e35a45b58ea6979b92283ba6e44040223a64\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c315208fda098a36b225a63347f5fd4c7ec4c6a07535d21d4963c136d75dda8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f1891bb22a9e5664f3026841b58d9ab6c8ff3d4c1597f502e3c8daf82fd67c78\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b3baf3122d7f4fb81c398e67dce1c007a39d77c1b944b2eb6d102ea948b9366e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2906b56422a5d1e18029f8dfe9f583868b1f6413dbb86a0e4489258e2491aee2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea79ff6eb5f370812a6f750d2a475542d4729e79ab7de6f1e3b51b10c9ff15f4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"53525895e62d7603774165b95492f86a299a94e811b8bfa096068557dc3b7079\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0aabe65457a62852cbc3f5efd4c9afd908cc365b81ff4ccff45d69457999be4f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8efe4c813ac88cde94cfd4bea026c778ccd1fc314df55d6fc5a83b02e37d153e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a5e8be6e6efa0995666cde2b04ee89d684553a2c184ce9d65be941363760f6aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a8c66d50ffdf82d6ecae69a1c0971f324d61cb035754e672c09e1374920c130f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3a98a433d7e13f7037d129fb607c0aa6be8e2786ab529798075891f1caa2e2a6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9aa33d1f7ee5b6f87dfab107560c9553ff008f5f640805b76152726175c3c7a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ef747846c68074cb6f3e6a721fe746c946c0fd87b764ad0f32c0db14a530760c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"105f27cff377e7455202b357006b2ff9c435dd06d077a77766a438b920e65ecb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6ea9e47cbae52d5f98c27737783d0dc37f05ed89537af90900d99ba724786368\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b53dd5318f075895d6819e8d4ceffc9d62fa37419025365efad5d4c37c032ae2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a4fbcc35d3dd061cbfe1038d04f72a085a63f22e6e41e51732d576dcf511ae51\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"774123679310f86a6cee928712e1340beda60d2cfd92fbbd2c0879a79005ee42\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c845c4a191326e7c9ecf6da0b052a10671217a1380a0016bca9315386f48ca03\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dde723c1559b7f93ce7e2cffbcf1cf349ad8c296646082c81a7499be56862cd1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9d8f49969e71ac351537bf21d0ed0bc0dc5eb1695291c30737b293be5df9682f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"22b1883b4b523fcb5aa2347e32fc0852b420c0da88d30eb8ccec885b0647939d\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9dc5ba2a85da2966998ed0d77f55d9da2820d7f5d7306991557614037e39a0cc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3a4b1c0e3136e893a0ff6adebc7676449cb25c1230b5628462c88499dc931fae\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c7c1445e34f1134341c70b2411f384cfef83a00287915d9a085d8ab6d61f0f5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c2af1523299b2ae906db2cfc1bc1eca9f96ff5bcf739238555d11eab67499efe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bd6ed37fff73ea134b5c2e7eef124891ca252106484efbdc80756cc354e3ea56\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"750010eae93e29ff523a99ba4e5ef57554664f3213920e75c1959e2db0176128\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7aac3b22be2aee4090a6d0cb32dd002d0fad5a689857d4e92ee03a950b30e0c9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"74883f5b7e7a852327e008c7e9f03a1d91f98325beeb19c446f62796e6aef8d1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__aa5780d0\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"ede2d327eaa9101d\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__aa5780d0 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-simulator-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4d1ea02979cfe39c600e55838846c4eee4ddc92bb7fcfb3453cd070bcf3e2959\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/simulator-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"44fc74b91f49727f317f3fdebe4dddd5445c63c7601b59dbb817a847a2a1b2eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__8df432f6\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"d3d862418d0a6254\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__8df432f6 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7a590a/maas-trlp-premium-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a982cae2c9190837d5ea04d6ba343f2ddc2a96065c397c50678676b3e6e6c245\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/premium-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8bf7acafa93e755f68cfd59460e5a54df9f18ca04f2d003d86d0083de64598fe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6200b66035d445a0e4c1702bf2414c2e8877c2f2c473277de2bc9f6e9bf2fe8e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-w1-7a590a\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"035ae7b4aacac45527bf36277a7aad77aa4acceba99af38797fa4f951905ee54\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7a590a-maas-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6e9eee33\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6e9eee33 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7a590a\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"34cdd18da494efc76065ea82ac3395638e9aca5c40abbd53c0f4538612f07d35\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/e2e-models-e2e-worker-w1-7a590a/models/e2e/distinct-2-w1-7a590a\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w1-7a590a"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w1-7a590a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:27.757Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-10-30T12:50:59Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:50:59Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:51:07Z"}],"name":"4c7e28c4ea66d3867db6e2053d338fd95c76975fa4ce24e65e7850a19b58e263","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"35987","uid":"3931aabe-7b27-4b6a-8dce-24d53712d06f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4c7e28c4ea66d3867db6e2053d338fd95c76975fa4ce24e65e7850a19b58e263"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:51:07Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:51:07Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4c7e28c4ea66d3867db6e2053d338fd95c76975fa4ce24e65e7850a19b58e263"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4c7e28c4ea66d3867db6e2053d338fd95c76975fa4ce24e65e7850a19b58e263\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:27.779Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-10-30T12:48:22Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:48:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:48:42Z"}],"name":"6ef9659353658fa30f8a50bb13e2e8523254919072f9604a5929a5ceb0a6bc17","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"30073","uid":"206ff993-da93-4da6-8f1e-0e67cc6664db"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6ef9659353658fa30f8a50bb13e2e8523254919072f9604a5929a5ceb0a6bc17"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:48:23Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:48:23Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6ef9659353658fa30f8a50bb13e2e8523254919072f9604a5929a5ceb0a6bc17"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6ef9659353658fa30f8a50bb13e2e8523254919072f9604a5929a5ceb0a6bc17\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:27.800Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-10-30T12:47:43Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:48:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:48:41Z"}],"name":"e9a145d980170d0288208e686227f27cf4330221d68aa965fa696259630442c4","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"29969","uid":"b1213170-04cc-4046-a8eb-6c3e49c1707d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e9a145d980170d0288208e686227f27cf4330221d68aa965fa696259630442c4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:48:41Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:48:41Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e9a145d980170d0288208e686227f27cf4330221d68aa965fa696259630442c4"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e9a145d980170d0288208e686227f27cf4330221d68aa965fa696259630442c4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:27.823Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-10-30T12:53:56Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:53:56Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:53:57Z"}],"name":"46fc87d721087034978051b991603b15a1549a42ffd6a9f2d7540fa624d9fbe0","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"42404","uid":"b04491f6-d458-41a7-9704-cd330fbde1fe"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["46fc87d721087034978051b991603b15a1549a42ffd6a9f2d7540fa624d9fbe0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:53:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:53:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["46fc87d721087034978051b991603b15a1549a42ffd6a9f2d7540fa624d9fbe0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"46fc87d721087034978051b991603b15a1549a42ffd6a9f2d7540fa624d9fbe0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:27.848Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a#rule-6"},"creationTimestamp":"2026-10-30T12:47:09Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:49:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:49:18Z"}],"name":"3f89ae75a20ba19970a54ccc348cc608ebfca7566239d4f9b158f43febd42e55","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"31595","uid":"61227c24-5e4a-4057-b18b-cd1ace661fb9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3f89ae75a20ba19970a54ccc348cc608ebfca7566239d4f9b158f43febd42e55"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:49:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:49:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3f89ae75a20ba19970a54ccc348cc608ebfca7566239d4f9b158f43febd42e55"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3f89ae75a20ba19970a54ccc348cc608ebfca7566239d4f9b158f43febd42e55\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:27.873Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-10-30T12:53:11Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:53:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:53:12Z"}],"name":"9d94bdb074cd59e0eeb52465f57a2886f3010a3084bca915240c377dfa69371d","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"40532","uid":"7d5f9101-ce40-42ad-8fdb-a0164a92d561"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9d94bdb074cd59e0eeb52465f57a2886f3010a3084bca915240c377dfa69371d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:53:12Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:53:12Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9d94bdb074cd59e0eeb52465f57a2886f3010a3084bca915240c377dfa69371d"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9d94bdb074cd59e0eeb52465f57a2886f3010a3084bca915240c377dfa69371d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:27.896Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1#rule-1"},"creationTimestamp":"2026-10-30T12:46:57Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:48:42Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:48:42Z"}],"name":"8c0cd107e1fa6f004c9af05b8c3102f19ebfd173ca67bf6c06fdd17256eaba05","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"30087","uid":"73db35d0-bf98-4527-99d3-bf9d7e97aedd"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8c0cd107e1fa6f004c9af05b8c3102f19ebfd173ca67bf6c06fdd17256eaba05"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:46:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:46:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8c0cd107e1fa6f004c9af05b8c3102f19ebfd173ca67bf6c06fdd17256eaba05"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8c0cd107e1fa6f004c9af05b8c3102f19ebfd173ca67bf6c06fdd17256eaba05\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:27.917Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route#v1-model-routing"},"creationTimestamp":"2026-10-30T12:51:57Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:51:57Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:51:58Z"}],"name":"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"37815","uid":"490d96f2-483f-4018-890e-25ecf061205f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:51:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:51:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:27.939Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1#rule-2"},"creationTimestamp":"2026-10-30T12:46:56Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:48:42Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:48:42Z"}],"name":"ce573b3027ad9607006464b4e16f49dcac328bda3098dc2f9cbf0de48aa9d1a3","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"30085","uid":"7675301b-cbc8-450d-849e-4c513cf6f9cc"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ce573b3027ad9607006464b4e16f49dcac328bda3098dc2f9cbf0de48aa9d1a3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:46:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:46:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ce573b3027ad9607006464b4e16f49dcac328bda3098dc2f9cbf0de48aa9d1a3"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ce573b3027ad9607006464b4e16f49dcac328bda3098dc2f9cbf0de48aa9d1a3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:27.963Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-10-30T12:53:12Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:53:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:53:13Z"}],"name":"866ba8602385aeaa90e8ae78ada1be9ce63dd09727bf4ecc6c1fa758e828a9bd","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"40626","uid":"a99c2725-e926-4929-b05a-eaa7ec01993f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["866ba8602385aeaa90e8ae78ada1be9ce63dd09727bf4ecc6c1fa758e828a9bd"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:53:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:53:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["866ba8602385aeaa90e8ae78ada1be9ce63dd09727bf4ecc6c1fa758e828a9bd"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"866ba8602385aeaa90e8ae78ada1be9ce63dd09727bf4ecc6c1fa758e828a9bd\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:27.990Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-10-30T12:51:56Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:51:56Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:51:57Z"}],"name":"9ce8c2fa3380caeba39c62cfdb2e02b46776e4eac1f908f418140d9b7b883fe2","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"37761","uid":"88907f36-1f4f-4404-9d3d-6ff7345aa435"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9ce8c2fa3380caeba39c62cfdb2e02b46776e4eac1f908f418140d9b7b883fe2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:51:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:51:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9ce8c2fa3380caeba39c62cfdb2e02b46776e4eac1f908f418140d9b7b883fe2"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9ce8c2fa3380caeba39c62cfdb2e02b46776e4eac1f908f418140d9b7b883fe2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.011Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-10-30T12:48:28Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:49:18Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:49:19Z"}],"name":"44fc74b91f49727f317f3fdebe4dddd5445c63c7601b59dbb817a847a2a1b2eb","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"31615","uid":"6ad1ebcd-e170-48fb-bf78-104f8ba22f9a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["44fc74b91f49727f317f3fdebe4dddd5445c63c7601b59dbb817a847a2a1b2eb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:48:29Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:48:29Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["44fc74b91f49727f317f3fdebe4dddd5445c63c7601b59dbb817a847a2a1b2eb"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"44fc74b91f49727f317f3fdebe4dddd5445c63c7601b59dbb817a847a2a1b2eb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.033Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a#rule-2"},"creationTimestamp":"2026-10-30T12:47:09Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:49:18Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:49:18Z"}],"name":"dde723c1559b7f93ce7e2cffbcf1cf349ad8c296646082c81a7499be56862cd1","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"31604","uid":"9149fc4e-4688-4037-8574-e84a3934a2e8"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dde723c1559b7f93ce7e2cffbcf1cf349ad8c296646082c81a7499be56862cd1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:47:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:47:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["dde723c1559b7f93ce7e2cffbcf1cf349ad8c296646082c81a7499be56862cd1"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"dde723c1559b7f93ce7e2cffbcf1cf349ad8c296646082c81a7499be56862cd1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.053Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-10-30T12:48:22Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:48:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:48:41Z"}],"name":"8a140385139e5d1094af15ad091323d3ab199555833d87f4aab24de3d072b6e1","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"30057","uid":"fde61760-0805-43a0-a9bb-c4d6de7ca242"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8a140385139e5d1094af15ad091323d3ab199555833d87f4aab24de3d072b6e1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:48:41Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:48:41Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8a140385139e5d1094af15ad091323d3ab199555833d87f4aab24de3d072b6e1"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8a140385139e5d1094af15ad091323d3ab199555833d87f4aab24de3d072b6e1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.074Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-10-30T12:48:28Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:49:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:49:18Z"}],"name":"1cc8f595efea76e0d3eedd32969d77ea8835ab68928410c6c8b033bf46f72923","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"31548","uid":"a74f776b-8999-43ae-867f-891f3044a1a4"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1cc8f595efea76e0d3eedd32969d77ea8835ab68928410c6c8b033bf46f72923"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:48:28Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:48:28Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1cc8f595efea76e0d3eedd32969d77ea8835ab68928410c6c8b033bf46f72923"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1cc8f595efea76e0d3eedd32969d77ea8835ab68928410c6c8b033bf46f72923\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.096Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route#v1-completions-path"},"creationTimestamp":"2026-10-30T12:53:11Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:53:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:53:11Z"}],"name":"d277167c1aa8cacaa4008b08884917c3bf967bff3e5581e0d555489ad3f97e24","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"40516","uid":"949cde52-2aca-4f22-8ee3-10a683c1fcd5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d277167c1aa8cacaa4008b08884917c3bf967bff3e5581e0d555489ad3f97e24"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:53:11Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:53:11Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d277167c1aa8cacaa4008b08884917c3bf967bff3e5581e0d555489ad3f97e24"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d277167c1aa8cacaa4008b08884917c3bf967bff3e5581e0d555489ad3f97e24\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.116Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route#v1-responses-path"},"creationTimestamp":"2026-10-30T12:48:21Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:48:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:48:41Z"}],"name":"7cd969c2f8771fba44a7e483980f071aa82ff99f59db04390ca78ff143e778c0","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"29970","uid":"134f6452-3ccd-42f9-bac5-4e82490150a2"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7cd969c2f8771fba44a7e483980f071aa82ff99f59db04390ca78ff143e778c0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:48:41Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:48:41Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7cd969c2f8771fba44a7e483980f071aa82ff99f59db04390ca78ff143e778c0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7cd969c2f8771fba44a7e483980f071aa82ff99f59db04390ca78ff143e778c0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.137Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a#rule-4"},"creationTimestamp":"2026-10-30T12:47:09Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:49:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:49:18Z"}],"name":"c2af1523299b2ae906db2cfc1bc1eca9f96ff5bcf739238555d11eab67499efe","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"31555","uid":"f2907cac-e64b-4dcc-b05b-6535c4941e4c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c2af1523299b2ae906db2cfc1bc1eca9f96ff5bcf739238555d11eab67499efe"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:47:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:47:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c2af1523299b2ae906db2cfc1bc1eca9f96ff5bcf739238555d11eab67499efe"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c2af1523299b2ae906db2cfc1bc1eca9f96ff5bcf739238555d11eab67499efe\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.159Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-10-30T12:53:11Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:53:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:53:11Z"}],"name":"19bfec94f9532ea4b5b1ff4e22e34dccda05f7858053828e2a904551707f45dc","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"40518","uid":"c7e09bc0-05c9-4050-a1c6-89b6dc1bbd68"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["19bfec94f9532ea4b5b1ff4e22e34dccda05f7858053828e2a904551707f45dc"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:53:11Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:53:11Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["19bfec94f9532ea4b5b1ff4e22e34dccda05f7858053828e2a904551707f45dc"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"19bfec94f9532ea4b5b1ff4e22e34dccda05f7858053828e2a904551707f45dc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.181Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-10-30T12:48:30Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:49:18Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:49:18Z"}],"name":"3a378a4162f02d06b635ffcd9cd97fb7c9975eac68f0d956efd8c3576a6c096c","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"31567","uid":"3576405a-b953-4a71-90ad-b9c7132cd610"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3a378a4162f02d06b635ffcd9cd97fb7c9975eac68f0d956efd8c3576a6c096c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:48:30Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:48:30Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3a378a4162f02d06b635ffcd9cd97fb7c9975eac68f0d956efd8c3576a6c096c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3a378a4162f02d06b635ffcd9cd97fb7c9975eac68f0d956efd8c3576a6c096c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.202Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route#v1-completions-path"},"creationTimestamp":"2026-10-30T12:47:43Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:48:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:48:42Z"}],"name":"104f9b7f51a3df1f9430904dedb3f7a4cf21c6cc4c20557200b5472ed316a34b","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"30075","uid":"78cb7d20-2d0d-4842-b0ac-99889556bff4"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["104f9b7f51a3df1f9430904dedb3f7a4cf21c6cc4c20557200b5472ed316a34b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:47:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:47:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["104f9b7f51a3df1f9430904dedb3f7a4cf21c6cc4c20557200b5472ed316a34b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"104f9b7f51a3df1f9430904dedb3f7a4cf21c6cc4c20557200b5472ed316a34b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.224Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route#v1-responses-path"},"creationTimestamp":"2026-10-30T12:51:56Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:51:56Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:51:57Z"}],"name":"30449cf39f411e1cc4fa580c9f841e231a5d83f9d8c88b5c2dab8b705d0f2b52","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"37753","uid":"eb437885-9610-486c-9192-be3c388d28ca"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["30449cf39f411e1cc4fa580c9f841e231a5d83f9d8c88b5c2dab8b705d0f2b52"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:51:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:51:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["30449cf39f411e1cc4fa580c9f841e231a5d83f9d8c88b5c2dab8b705d0f2b52"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"30449cf39f411e1cc4fa580c9f841e231a5d83f9d8c88b5c2dab8b705d0f2b52\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.219Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T12:42:13Z","generation":32,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"13037da2-7ce3-408f-991b-ad31db53d1ff\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:44:45Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"13037da2-7ce3-408f-991b-ad31db53d1ff"}],"resourceVersion":"18597","uid":"044e9012-9183-4278-aac0-7fa080f81471"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"etcdserver: request is too large"}
{"level":"error","ts":"2026-10-30T13:10:28.243Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-10-30T12:53:11Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:53:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:53:13Z"}],"name":"11d94353721e19c51aa0bc6aaf17a915f0c4bc5c5b03c6670c645da71e67b0ab","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"40612","uid":"3665576a-20c2-4c80-a76b-09be513d02db"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["11d94353721e19c51aa0bc6aaf17a915f0c4bc5c5b03c6670c645da71e67b0ab"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:53:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:53:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["11d94353721e19c51aa0bc6aaf17a915f0c4bc5c5b03c6670c645da71e67b0ab"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"11d94353721e19c51aa0bc6aaf17a915f0c4bc5c5b03c6670c645da71e67b0ab\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.265Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-10-30T12:51:56Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:51:56Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:51:57Z"}],"name":"e3eeda6dee0071c64c151bbb71350df5353b1c91473127cebe525b54a04ae2cc","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"37772","uid":"4fb02849-33f3-4455-8863-1524da13b3f0"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e3eeda6dee0071c64c151bbb71350df5353b1c91473127cebe525b54a04ae2cc"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:51:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:51:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e3eeda6dee0071c64c151bbb71350df5353b1c91473127cebe525b54a04ae2cc"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e3eeda6dee0071c64c151bbb71350df5353b1c91473127cebe525b54a04ae2cc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.286Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route#v1-responses-path"},"creationTimestamp":"2026-10-30T12:53:56Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:53:56Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:53:57Z"}],"name":"671fede733c21121c0fa91b5b6cadbeceb86fb48425b13fa2b5f9d78803a82f0","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"42403","uid":"6faf1fdd-9407-4181-951e-04774358e525"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["671fede733c21121c0fa91b5b6cadbeceb86fb48425b13fa2b5f9d78803a82f0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:53:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:53:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["671fede733c21121c0fa91b5b6cadbeceb86fb48425b13fa2b5f9d78803a82f0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"671fede733c21121c0fa91b5b6cadbeceb86fb48425b13fa2b5f9d78803a82f0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.308Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-10-30T12:53:56Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:53:56Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:53:56Z"}],"name":"b7fd9eb41424bdbacdb2d2be398f7f3d33ee8577e46641724bb6c847f8a39b50","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"42378","uid":"787e9ce9-d412-41b8-90d3-c8dd4006b1b7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b7fd9eb41424bdbacdb2d2be398f7f3d33ee8577e46641724bb6c847f8a39b50"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:53:56Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:53:56Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b7fd9eb41424bdbacdb2d2be398f7f3d33ee8577e46641724bb6c847f8a39b50"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b7fd9eb41424bdbacdb2d2be398f7f3d33ee8577e46641724bb6c847f8a39b50\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.328Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-10-30T12:47:43Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:48:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:48:41Z"}],"name":"054858abf03d49266e8b2b24aacaec6285f09f0adfa2239155a173261bdcca7c","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"29956","uid":"3a8c19f5-92b9-405b-a45d-3722748a43ad"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["054858abf03d49266e8b2b24aacaec6285f09f0adfa2239155a173261bdcca7c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:48:41Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:48:41Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["054858abf03d49266e8b2b24aacaec6285f09f0adfa2239155a173261bdcca7c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"054858abf03d49266e8b2b24aacaec6285f09f0adfa2239155a173261bdcca7c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.349Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-10-30T12:50:59Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:50:59Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:51:07Z"}],"name":"8c4d0e21c666fd015a2db768ffb20bedac801efe539190c06ca7594e9010af8c","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"35988","uid":"66153348-2a20-49c4-9078-b8a237a64868"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8c4d0e21c666fd015a2db768ffb20bedac801efe539190c06ca7594e9010af8c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:51:07Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:51:07Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8c4d0e21c666fd015a2db768ffb20bedac801efe539190c06ca7594e9010af8c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8c4d0e21c666fd015a2db768ffb20bedac801efe539190c06ca7594e9010af8c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.370Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-10-30T12:47:43Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:48:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:48:42Z"}],"name":"c2d72b7f90bb96f33e2e1b00416be5fdbcedf88bc9b8577dd76935f6319a4e60","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"30072","uid":"46782a3e-c388-4641-a6c0-66964e5b911b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c2d72b7f90bb96f33e2e1b00416be5fdbcedf88bc9b8577dd76935f6319a4e60"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:47:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:47:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c2d72b7f90bb96f33e2e1b00416be5fdbcedf88bc9b8577dd76935f6319a4e60"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c2d72b7f90bb96f33e2e1b00416be5fdbcedf88bc9b8577dd76935f6319a4e60\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.391Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route#v1-model-routing"},"creationTimestamp":"2026-10-30T12:48:21Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:48:42Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:48:42Z"}],"name":"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"30077","uid":"4bf91392-11a1-4557-bada-aa1733ad8eee"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:48:22Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:48:22Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.411Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-10-30T12:48:21Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:48:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:48:41Z"}],"name":"b7432eac2809c3393fb8b46df502f39f77e27e5e88eff0e8835bfdb185fa9eef","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"29964","uid":"a6b8f183-dcc1-4033-8f7f-36644e7741b4"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b7432eac2809c3393fb8b46df502f39f77e27e5e88eff0e8835bfdb185fa9eef"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:48:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:48:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b7432eac2809c3393fb8b46df502f39f77e27e5e88eff0e8835bfdb185fa9eef"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b7432eac2809c3393fb8b46df502f39f77e27e5e88eff0e8835bfdb185fa9eef\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.434Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-10-30T12:47:51Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:49:18Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:49:21Z"}],"name":"f0f1429576f1a1be321185e1bd6abb819aea50327fda0269d5612db65c382cfd","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"31687","uid":"28f629e4-d304-45ff-9855-4ef02499b64c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f0f1429576f1a1be321185e1bd6abb819aea50327fda0269d5612db65c382cfd"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:47:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:47:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f0f1429576f1a1be321185e1bd6abb819aea50327fda0269d5612db65c382cfd"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f0f1429576f1a1be321185e1bd6abb819aea50327fda0269d5612db65c382cfd\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.454Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-10-30T12:47:50Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:49:18Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:49:21Z"}],"name":"105f27cff377e7455202b357006b2ff9c435dd06d077a77766a438b920e65ecb","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"31684","uid":"2b3e8749-1a76-4f40-8f9f-51887aad1478"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["105f27cff377e7455202b357006b2ff9c435dd06d077a77766a438b920e65ecb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:47:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:47:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["105f27cff377e7455202b357006b2ff9c435dd06d077a77766a438b920e65ecb"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"105f27cff377e7455202b357006b2ff9c435dd06d077a77766a438b920e65ecb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.476Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-53dcb1#rule-4"},"creationTimestamp":"2026-10-30T12:46:56Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:48:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:48:41Z"}],"name":"4f9ad3ea2cb0afdd240e7a999cacd6f99c830a43e8d5ae688123da58c428bec2","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"29997","uid":"c5bd8c98-3089-4251-91b8-3ed72d580cf7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4f9ad3ea2cb0afdd240e7a999cacd6f99c830a43e8d5ae688123da58c428bec2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:48:41Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:48:41Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4f9ad3ea2cb0afdd240e7a999cacd6f99c830a43e8d5ae688123da58c428bec2"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4f9ad3ea2cb0afdd240e7a999cacd6f99c830a43e8d5ae688123da58c428bec2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.496Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-10-30T12:53:57Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:53:57Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:53:57Z"}],"name":"3ae6be995c08f6214b9af6f7ee2efd55d8f0b2fb8b2e04829e5955c670b7b74d","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"42419","uid":"4497279c-494e-41d2-b7e5-a31f1b4e3bcc"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3ae6be995c08f6214b9af6f7ee2efd55d8f0b2fb8b2e04829e5955c670b7b74d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:53:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:53:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3ae6be995c08f6214b9af6f7ee2efd55d8f0b2fb8b2e04829e5955c670b7b74d"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3ae6be995c08f6214b9af6f7ee2efd55d8f0b2fb8b2e04829e5955c670b7b74d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.517Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route#v1-completions-path"},"creationTimestamp":"2026-10-30T12:51:57Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:51:57Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:51:58Z"}],"name":"0adc57d51b35181d57ce7070149cb9dcb5a1c35659398baa1c2c66f130cf379f","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"37819","uid":"94f41fd5-213c-4236-b2fd-f77778491825"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0adc57d51b35181d57ce7070149cb9dcb5a1c35659398baa1c2c66f130cf379f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:51:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:51:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0adc57d51b35181d57ce7070149cb9dcb5a1c35659398baa1c2c66f130cf379f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0adc57d51b35181d57ce7070149cb9dcb5a1c35659398baa1c2c66f130cf379f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.537Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-10-30T12:53:12Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:53:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:53:13Z"}],"name":"ce47c00ef51de8c42dff484190186d5315e9812635a34ef8cbec474b4571879a","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"40622","uid":"3fff669e-3190-449e-96af-9843a038e302"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ce47c00ef51de8c42dff484190186d5315e9812635a34ef8cbec474b4571879a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:53:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:53:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ce47c00ef51de8c42dff484190186d5315e9812635a34ef8cbec474b4571879a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ce47c00ef51de8c42dff484190186d5315e9812635a34ef8cbec474b4571879a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.558Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route#v1-completions-path"},"creationTimestamp":"2026-10-30T12:48:28Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:49:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:49:18Z"}],"name":"eceaa3373eca8aa1fa797e413753c17981f4395ea7c9e6478abf3dbb81e8216b","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"31546","uid":"f708be37-0de6-473c-95d0-180c434c6538"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["eceaa3373eca8aa1fa797e413753c17981f4395ea7c9e6478abf3dbb81e8216b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:48:29Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:48:29Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["eceaa3373eca8aa1fa797e413753c17981f4395ea7c9e6478abf3dbb81e8216b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"eceaa3373eca8aa1fa797e413753c17981f4395ea7c9e6478abf3dbb81e8216b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.578Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-10-30T12:48:29Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:49:18Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:49:18Z"}],"name":"96a10edf633153472e430c6c2106fabd9d088950913cb891f8d1131e8e85d5da","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"31593","uid":"ef1af5d2-eda4-4627-bd98-e6bf6a4bf7e5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["96a10edf633153472e430c6c2106fabd9d088950913cb891f8d1131e8e85d5da"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:48:31Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:48:31Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["96a10edf633153472e430c6c2106fabd9d088950913cb891f8d1131e8e85d5da"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"96a10edf633153472e430c6c2106fabd9d088950913cb891f8d1131e8e85d5da\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.603Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route#v1-messages-path"},"creationTimestamp":"2026-10-30T12:51:57Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:51:57Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:51:58Z"}],"name":"cdf3e72f09d9c23ed7de62e42d53e35a45b58ea6979b92283ba6e44040223a64","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"37810","uid":"d3e372b9-c137-4c64-8d21-ead171c43511"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cdf3e72f09d9c23ed7de62e42d53e35a45b58ea6979b92283ba6e44040223a64"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:51:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:51:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["cdf3e72f09d9c23ed7de62e42d53e35a45b58ea6979b92283ba6e44040223a64"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"cdf3e72f09d9c23ed7de62e42d53e35a45b58ea6979b92283ba6e44040223a64\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.624Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route#v1-responses-path"},"creationTimestamp":"2026-10-30T12:53:12Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:53:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:53:13Z"}],"name":"b444fff7c731702df9c43dd18a342ed5f4b84acbd2ae2c04e246e2ddadc11c94","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"40631","uid":"08c8f9f4-27a3-4e7b-ab6c-c8e66936a7d0"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b444fff7c731702df9c43dd18a342ed5f4b84acbd2ae2c04e246e2ddadc11c94"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:53:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:53:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b444fff7c731702df9c43dd18a342ed5f4b84acbd2ae2c04e246e2ddadc11c94"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b444fff7c731702df9c43dd18a342ed5f4b84acbd2ae2c04e246e2ddadc11c94\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.645Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-10-30T12:47:51Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:49:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:49:17Z"}],"name":"df21e7cfc8f3ee440a1487e95ff0c570ae804b786dd01a0d794bd1f3a9985389","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"31509","uid":"4581975b-11d0-4c18-93b6-1c67d96e613e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["df21e7cfc8f3ee440a1487e95ff0c570ae804b786dd01a0d794bd1f3a9985389"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:47:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:47:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["df21e7cfc8f3ee440a1487e95ff0c570ae804b786dd01a0d794bd1f3a9985389"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"df21e7cfc8f3ee440a1487e95ff0c570ae804b786dd01a0d794bd1f3a9985389\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.666Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-10-30T12:50:59Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:50:59Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:51:07Z"}],"name":"d15c406a43328781f512c3e6de986a018b3122ac39a7a4cbc136e998b2b48492","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"36006","uid":"c0403f50-722b-4fcb-a7d1-f37d3445706f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d15c406a43328781f512c3e6de986a018b3122ac39a7a4cbc136e998b2b48492"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:51:07Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:51:07Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d15c406a43328781f512c3e6de986a018b3122ac39a7a4cbc136e998b2b48492"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d15c406a43328781f512c3e6de986a018b3122ac39a7a4cbc136e998b2b48492\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.689Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-10-30T12:47:43Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:48:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:48:40Z"}],"name":"1e238b7d9e3f5d63d4bb1b2c1e20a3b8446c915d602f4a498ff5e32b26494ce9","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"29922","uid":"bed703ef-69fa-42d2-b8f8-478fd3b64abf"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1e238b7d9e3f5d63d4bb1b2c1e20a3b8446c915d602f4a498ff5e32b26494ce9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:47:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:47:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1e238b7d9e3f5d63d4bb1b2c1e20a3b8446c915d602f4a498ff5e32b26494ce9"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1e238b7d9e3f5d63d4bb1b2c1e20a3b8446c915d602f4a498ff5e32b26494ce9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.709Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-10-30T12:53:57Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:53:57Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:53:57Z"}],"name":"4e43587797a9f0e99f41485cc6382657fd275bc0456caa79ddfb81c0a3829ce8","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"42418","uid":"2b2a9074-0303-42a0-8ff6-dde4ea76e437"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4e43587797a9f0e99f41485cc6382657fd275bc0456caa79ddfb81c0a3829ce8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:53:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:53:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4e43587797a9f0e99f41485cc6382657fd275bc0456caa79ddfb81c0a3829ce8"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4e43587797a9f0e99f41485cc6382657fd275bc0456caa79ddfb81c0a3829ce8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.730Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-10-30T12:51:57Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:51:57Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:52:05Z"}],"name":"82a9c25434b61c4772a1ac29246cbb75b1b553266861c57cdeeb5d939581bbaa","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"38089","uid":"ef8de26b-c5e8-4389-a52c-a3a96015b5d1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["82a9c25434b61c4772a1ac29246cbb75b1b553266861c57cdeeb5d939581bbaa"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:52:04Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:52:04Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["82a9c25434b61c4772a1ac29246cbb75b1b553266861c57cdeeb5d939581bbaa"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"82a9c25434b61c4772a1ac29246cbb75b1b553266861c57cdeeb5d939581bbaa\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.752Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route#v1-model-routing"},"creationTimestamp":"2026-10-30T12:48:29Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:49:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:49:18Z"}],"name":"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"31559","uid":"d452d43d-d2f7-4480-bdee-07e2c752b96d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:48:30Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:48:30Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.773Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route#v1-completions-path"},"creationTimestamp":"2026-10-30T12:53:57Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:53:57Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:53:58Z"}],"name":"5e2828e21483a361ca7af9667f8d2d5b6b368fff80e00b61868847aed179c479","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"42480","uid":"aca1a742-6a4b-44c4-853a-1054ecd8ea85"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5e2828e21483a361ca7af9667f8d2d5b6b368fff80e00b61868847aed179c479"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:53:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:53:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5e2828e21483a361ca7af9667f8d2d5b6b368fff80e00b61868847aed179c479"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5e2828e21483a361ca7af9667f8d2d5b6b368fff80e00b61868847aed179c479\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.794Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-10-30T12:48:29Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:49:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:49:17Z"}],"name":"b457a46f3c297a562935e2446d9043cdc1001219a34f31aa169362f32a741476","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"31524","uid":"822718cd-e818-44d3-a6fc-8c39999a1262"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b457a46f3c297a562935e2446d9043cdc1001219a34f31aa169362f32a741476"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:48:30Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:48:30Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b457a46f3c297a562935e2446d9043cdc1001219a34f31aa169362f32a741476"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b457a46f3c297a562935e2446d9043cdc1001219a34f31aa169362f32a741476\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.814Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-10-30T12:47:51Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:49:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:49:17Z"}],"name":"a149d9912ccbb2cd4dd7e07e1172f90c639e64a98b99b9a1967bc3c9bf5d8205","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"31540","uid":"0261cfd8-31ef-403f-9440-574fd5e13415"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a149d9912ccbb2cd4dd7e07e1172f90c639e64a98b99b9a1967bc3c9bf5d8205"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:47:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:47:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a149d9912ccbb2cd4dd7e07e1172f90c639e64a98b99b9a1967bc3c9bf5d8205"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a149d9912ccbb2cd4dd7e07e1172f90c639e64a98b99b9a1967bc3c9bf5d8205\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.837Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-10-30T12:50:58Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:50:58Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:51:00Z"}],"name":"068abb543fe2d8904c85c4227e66d1127808e1da52374db674dc113c87dc522c","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"35566","uid":"f55ba2c9-6b21-4083-91c8-272fd6d5ad44"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["068abb543fe2d8904c85c4227e66d1127808e1da52374db674dc113c87dc522c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:51:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:51:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["068abb543fe2d8904c85c4227e66d1127808e1da52374db674dc113c87dc522c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"068abb543fe2d8904c85c4227e66d1127808e1da52374db674dc113c87dc522c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.858Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route#v1-messages-path"},"creationTimestamp":"2026-10-30T12:53:11Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:53:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:53:12Z"}],"name":"076a038410428b9ac2bad029581c01b28cffd7b7f1a64c56465ca488c625b3c5","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"40583","uid":"18aa5a30-6060-47c4-94bc-5c81456def5a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["076a038410428b9ac2bad029581c01b28cffd7b7f1a64c56465ca488c625b3c5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:53:12Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:53:12Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["076a038410428b9ac2bad029581c01b28cffd7b7f1a64c56465ca488c625b3c5"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"076a038410428b9ac2bad029581c01b28cffd7b7f1a64c56465ca488c625b3c5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.879Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-10-30T12:48:30Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:49:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:49:17Z"}],"name":"774123679310f86a6cee928712e1340beda60d2cfd92fbbd2c0879a79005ee42","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"31531","uid":"d5029381-5ba6-46cd-991c-5e7653c89b3b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["774123679310f86a6cee928712e1340beda60d2cfd92fbbd2c0879a79005ee42"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:49:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:49:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["774123679310f86a6cee928712e1340beda60d2cfd92fbbd2c0879a79005ee42"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"774123679310f86a6cee928712e1340beda60d2cfd92fbbd2c0879a79005ee42\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.899Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-10-30T12:51:56Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:51:56Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:51:57Z"}],"name":"035ae7b4aacac45527bf36277a7aad77aa4acceba99af38797fa4f951905ee54","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"37749","uid":"945f4408-52cb-4b38-97b8-c2c2cc5a293d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["035ae7b4aacac45527bf36277a7aad77aa4acceba99af38797fa4f951905ee54"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:51:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:51:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["035ae7b4aacac45527bf36277a7aad77aa4acceba99af38797fa4f951905ee54"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"035ae7b4aacac45527bf36277a7aad77aa4acceba99af38797fa4f951905ee54\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.920Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route#v1-responses-path"},"creationTimestamp":"2026-10-30T12:50:58Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:50:58Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:50:58Z"}],"name":"2906b56422a5d1e18029f8dfe9f583868b1f6413dbb86a0e4489258e2491aee2","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"35486","uid":"94c84daf-6a1f-4ea9-a140-932ba4653cd9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2906b56422a5d1e18029f8dfe9f583868b1f6413dbb86a0e4489258e2491aee2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:50:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:50:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2906b56422a5d1e18029f8dfe9f583868b1f6413dbb86a0e4489258e2491aee2"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2906b56422a5d1e18029f8dfe9f583868b1f6413dbb86a0e4489258e2491aee2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.941Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-10-30T12:48:22Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:48:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:48:41Z"}],"name":"848ef614bc7f06bf3e510719cdaccc63c032f4baa9511a3271180a15243597be","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"30029","uid":"bfb04e7c-3165-43eb-8303-ace40ee2207f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["848ef614bc7f06bf3e510719cdaccc63c032f4baa9511a3271180a15243597be"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:48:23Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:48:23Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["848ef614bc7f06bf3e510719cdaccc63c032f4baa9511a3271180a15243597be"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"848ef614bc7f06bf3e510719cdaccc63c032f4baa9511a3271180a15243597be\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.966Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-10-30T12:48:22Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:48:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:48:41Z"}],"name":"f09d09fc6dde1d236524d4d6dcb928bdcf139e1b1ce84cce5a5a61d0dfbe9a0d","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"29960","uid":"feba135f-04d6-42bf-8178-4ee367ab1618"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f09d09fc6dde1d236524d4d6dcb928bdcf139e1b1ce84cce5a5a61d0dfbe9a0d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:48:41Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:48:41Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f09d09fc6dde1d236524d4d6dcb928bdcf139e1b1ce84cce5a5a61d0dfbe9a0d"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f09d09fc6dde1d236524d4d6dcb928bdcf139e1b1ce84cce5a5a61d0dfbe9a0d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:28.992Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-10-30T12:47:51Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:49:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:49:18Z"}],"name":"e85025d98da554ebf7c487d2062eb7fa47a1b3d6adb7b480115a5ce4cefb0483","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"31589","uid":"aae11386-5eba-4617-8280-0446cb21e332"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e85025d98da554ebf7c487d2062eb7fa47a1b3d6adb7b480115a5ce4cefb0483"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:49:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:49:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e85025d98da554ebf7c487d2062eb7fa47a1b3d6adb7b480115a5ce4cefb0483"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e85025d98da554ebf7c487d2062eb7fa47a1b3d6adb7b480115a5ce4cefb0483\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:29.015Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/distinct-2-w1-7a590a-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-10-30T12:51:56Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:51:56Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:51:57Z"}],"name":"9aa33d1f7ee5b6f87dfab107560c9553ff008f5f640805b76152726175c3c7a0","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"37764","uid":"6cd885ac-6b75-46be-9de8-8ce1a650ea7a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9aa33d1f7ee5b6f87dfab107560c9553ff008f5f640805b76152726175c3c7a0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:51:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:51:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9aa33d1f7ee5b6f87dfab107560c9553ff008f5f640805b76152726175c3c7a0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9aa33d1f7ee5b6f87dfab107560c9553ff008f5f640805b76152726175c3c7a0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:29.039Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route#v1-model-routing"},"creationTimestamp":"2026-10-30T12:53:56Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:53:56Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:53:57Z"}],"name":"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"42395","uid":"83dce994-5917-4735-8128-dd83ae412d34"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:53:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:53:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:29.062Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-10-30T12:47:51Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:49:18Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:49:19Z"}],"name":"f41fcbb289a766d6a29268d2be644d886254d678311240795320efb90fdad5eb","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"31605","uid":"cc792912-7ae4-4327-8464-6f4b0da7f3b7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f41fcbb289a766d6a29268d2be644d886254d678311240795320efb90fdad5eb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:47:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:47:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f41fcbb289a766d6a29268d2be644d886254d678311240795320efb90fdad5eb"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f41fcbb289a766d6a29268d2be644d886254d678311240795320efb90fdad5eb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w4-53dcb1","event":"UPDATE"}
{"level":"info","ts":"2026-10-30T13:10:29Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-10-30T13:10:29Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-10-30T13:10:29Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-10-30T13:10:29.084Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-10-30T12:48:22Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:48:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:48:40Z"}],"name":"05daa6d986fd5a49c2023f2b7516d814e699fceafa44c99344553fea00c14848","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"29918","uid":"257fda47-7df5-407b-a24a-8106e901e115"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["05daa6d986fd5a49c2023f2b7516d814e699fceafa44c99344553fea00c14848"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:48:22Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:48:22Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["05daa6d986fd5a49c2023f2b7516d814e699fceafa44c99344553fea00c14848"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"05daa6d986fd5a49c2023f2b7516d814e699fceafa44c99344553fea00c14848\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:29.105Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-10-30T12:53:11Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:53:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:53:12Z"}],"name":"d698cb3490c21dc5d10c6de9a6bc389ce436a75532ce382d151ae459332e57ee","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"40599","uid":"804eeb01-c89a-4d2d-88a4-822d37d0c3dd"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d698cb3490c21dc5d10c6de9a6bc389ce436a75532ce382d151ae459332e57ee"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:53:12Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:53:12Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d698cb3490c21dc5d10c6de9a6bc389ce436a75532ce382d151ae459332e57ee"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d698cb3490c21dc5d10c6de9a6bc389ce436a75532ce382d151ae459332e57ee\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-10-30T13:10:29Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w4-53dcb1","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w4-53dcb1","reconcileID":"5f7344a9-17c6-41a8-8497-26392b98d7d1","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-worker-w4-53dcb1","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-10-30T13:10:29.126Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a#rule-1"},"creationTimestamp":"2026-10-30T12:47:09Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:49:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:49:17Z"}],"name":"750010eae93e29ff523a99ba4e5ef57554664f3213920e75c1959e2db0176128","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"31521","uid":"16389ac3-8c46-4ab2-9490-b2cbac87ae45"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["750010eae93e29ff523a99ba4e5ef57554664f3213920e75c1959e2db0176128"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:49:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:49:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["750010eae93e29ff523a99ba4e5ef57554664f3213920e75c1959e2db0176128"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"750010eae93e29ff523a99ba4e5ef57554664f3213920e75c1959e2db0176128\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:29Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w4-53dcb1","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w4-53dcb1","reconcileID":"bcdb1d0d-8350-4c76-90d4-907ac857eb68","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-worker-w4-53dcb1\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.23.3/pkg/internal/controller/controller.go:495\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.23.3/pkg/internal/controller/controller.go:438\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func1.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.23.3/pkg/internal/controller/controller.go:313"}
{"level":"info","ts":"2026-10-30T13:10:29Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w4-53dcb1","event":"DELETE"}
{"level":"info","ts":"2026-10-30T13:10:29Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-10-30T13:10:29Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-worker-w4-53dcb1\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:445\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.23.3/pkg/internal/controller/controller.go:222\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.23.3/pkg/internal/controller/controller.go:479\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.23.3/pkg/internal/controller/controller.go:438\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func1.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.23.3/pkg/internal/controller/controller.go:313"}
{"level":"info","ts":"2026-10-30T13:10:29Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-10-30T13:10:29.149Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7a590a#rule-3"},"creationTimestamp":"2026-10-30T12:47:09Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:49:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:49:17Z"}],"name":"3a4b1c0e3136e893a0ff6adebc7676449cb25c1230b5628462c88499dc931fae","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"31511","uid":"cf34f511-15e8-42e0-816e-c70fab9f3a87"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3a4b1c0e3136e893a0ff6adebc7676449cb25c1230b5628462c88499dc931fae"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:47:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:47:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3a4b1c0e3136e893a0ff6adebc7676449cb25c1230b5628462c88499dc931fae"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3a4b1c0e3136e893a0ff6adebc7676449cb25c1230b5628462c88499dc931fae\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:29.172Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route#v1-responses-path"},"creationTimestamp":"2026-10-30T12:47:51Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:49:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:49:18Z"}],"name":"1031e5fe412033da350814ac517fe44eb0eae32dbb531ffb2414912a07a0c15f","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"31565","uid":"cb42623f-bb26-4af7-bf12-75ecafe4c5b2"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1031e5fe412033da350814ac517fe44eb0eae32dbb531ffb2414912a07a0c15f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:47:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:47:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1031e5fe412033da350814ac517fe44eb0eae32dbb531ffb2414912a07a0c15f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1031e5fe412033da350814ac517fe44eb0eae32dbb531ffb2414912a07a0c15f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:29.194Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route#v1-messages-path"},"creationTimestamp":"2026-10-30T12:48:30Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:49:18Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:49:18Z"}],"name":"a8c66d50ffdf82d6ecae69a1c0971f324d61cb035754e672c09e1374920c130f","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"31573","uid":"1db73275-8653-4c33-8c6e-baa5e3f3120a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a8c66d50ffdf82d6ecae69a1c0971f324d61cb035754e672c09e1374920c130f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:48:31Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:48:31Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a8c66d50ffdf82d6ecae69a1c0971f324d61cb035754e672c09e1374920c130f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a8c66d50ffdf82d6ecae69a1c0971f324d61cb035754e672c09e1374920c130f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:29.214Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-10-30T12:53:12Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:53:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:53:13Z"}],"name":"8013b4888d8c0c89f4fb91ca2c345624f24083cc7b8ea83841c85560e17fd789","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"40625","uid":"0beed378-15dd-4f9f-876e-7f645936efb0"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8013b4888d8c0c89f4fb91ca2c345624f24083cc7b8ea83841c85560e17fd789"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:53:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:53:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8013b4888d8c0c89f4fb91ca2c345624f24083cc7b8ea83841c85560e17fd789"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8013b4888d8c0c89f4fb91ca2c345624f24083cc7b8ea83841c85560e17fd789\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:29.236Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/simulator-w1-7a590a-kserve-route#v1-completions-path"},"creationTimestamp":"2026-10-30T12:47:51Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:49:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:49:17Z"}],"name":"1ae748d971f49d47d371205b68e94c4d734abb4b723a86bcb07504627759dc89","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"31489","uid":"4bfdcd21-ad3f-4f5b-81fc-55be19a8e841"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1ae748d971f49d47d371205b68e94c4d734abb4b723a86bcb07504627759dc89"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:47:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:47:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1ae748d971f49d47d371205b68e94c4d734abb4b723a86bcb07504627759dc89"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1ae748d971f49d47d371205b68e94c4d734abb4b723a86bcb07504627759dc89\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:29.257Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route#v1-completions-path"},"creationTimestamp":"2026-10-30T12:50:58Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:50:58Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:50:59Z"}],"name":"23aab9fbc666b3e1b9b9e93c16a3f2a3603bc75c70d345208c83efb52c885c12","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"35539","uid":"3241519f-789e-4f53-a9b4-abb58621fbf8"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["23aab9fbc666b3e1b9b9e93c16a3f2a3603bc75c70d345208c83efb52c885c12"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:50:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:50:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["23aab9fbc666b3e1b9b9e93c16a3f2a3603bc75c70d345208c83efb52c885c12"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"23aab9fbc666b3e1b9b9e93c16a3f2a3603bc75c70d345208c83efb52c885c12\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:29.277Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/distinct-w4-53dcb1-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-10-30T12:53:12Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:53:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:53:12Z"}],"name":"6ce786297e806878f759f8ebe30957c2bd515f34c8cd580c47396d68b73ee3d1","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"40591","uid":"da4cadf0-5501-4462-a5af-8c7442d5eaf7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6ce786297e806878f759f8ebe30957c2bd515f34c8cd580c47396d68b73ee3d1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:53:12Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:53:12Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6ce786297e806878f759f8ebe30957c2bd515f34c8cd580c47396d68b73ee3d1"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6ce786297e806878f759f8ebe30957c2bd515f34c8cd580c47396d68b73ee3d1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:29.298Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-10-30T12:47:43Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:48:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:48:41Z"}],"name":"006181ea19644569eba45d273bd8a4fc3b9b2bd4ecbd3ef11fbb23f3a488daba","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"29953","uid":"99eb7847-ede4-401f-8f2d-b7a07841312d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["006181ea19644569eba45d273bd8a4fc3b9b2bd4ecbd3ef11fbb23f3a488daba"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:48:41Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:48:41Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["006181ea19644569eba45d273bd8a4fc3b9b2bd4ecbd3ef11fbb23f3a488daba"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"006181ea19644569eba45d273bd8a4fc3b9b2bd4ecbd3ef11fbb23f3a488daba\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:29.318Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route#v1-messages-path"},"creationTimestamp":"2026-10-30T12:53:56Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:53:56Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:53:56Z"}],"name":"2a63b0542f7d5e9ab21ff2a70e875d9016c654a34be4af8b2862093443d15c51","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"42383","uid":"e5f0e43f-e47c-45ba-8a2b-a3db0f9f7425"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2a63b0542f7d5e9ab21ff2a70e875d9016c654a34be4af8b2862093443d15c51"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:53:56Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:53:56Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2a63b0542f7d5e9ab21ff2a70e875d9016c654a34be4af8b2862093443d15c51"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2a63b0542f7d5e9ab21ff2a70e875d9016c654a34be4af8b2862093443d15c51\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:29.338Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/simulator-w4-53dcb1-kserve-route#v1-messages-path"},"creationTimestamp":"2026-10-30T12:47:43Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:48:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:48:40Z"}],"name":"17173ba26c2e665c9e0e4ef6ffc67fd759e864382b5cbe50edc98a2bdae7ddd4","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"29908","uid":"ea86b8f1-ef76-49cb-a210-19c11b00fe67"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["17173ba26c2e665c9e0e4ef6ffc67fd759e864382b5cbe50edc98a2bdae7ddd4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:47:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:47:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["17173ba26c2e665c9e0e4ef6ffc67fd759e864382b5cbe50edc98a2bdae7ddd4"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"17173ba26c2e665c9e0e4ef6ffc67fd759e864382b5cbe50edc98a2bdae7ddd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:29.359Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/distinct-w1-7a590a-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-10-30T12:50:58Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:50:58Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:50:59Z"}],"name":"9fcc31bf477a6a539b09c1dafa0d8c389f6af32511fb4c214235577254b96a22","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"35512","uid":"c1de2d23-cddb-42a0-8e0e-52b2e72b894b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9fcc31bf477a6a539b09c1dafa0d8c389f6af32511fb4c214235577254b96a22"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:50:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:50:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9fcc31bf477a6a539b09c1dafa0d8c389f6af32511fb4c214235577254b96a22"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9fcc31bf477a6a539b09c1dafa0d8c389f6af32511fb4c214235577254b96a22\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:29.380Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-7a590a/premium-w1-7a590a-kserve-route#v1-responses-path"},"creationTimestamp":"2026-10-30T12:48:30Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:49:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:49:17Z"}],"name":"53525895e62d7603774165b95492f86a299a94e811b8bfa096068557dc3b7079","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"31522","uid":"e80dadff-222d-4cff-b716-d0c2a2c68e6a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["53525895e62d7603774165b95492f86a299a94e811b8bfa096068557dc3b7079"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-7a590a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:48:31Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:48:31Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["53525895e62d7603774165b95492f86a299a94e811b8bfa096068557dc3b7079"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"53525895e62d7603774165b95492f86a299a94e811b8bfa096068557dc3b7079\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:29.401Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/premium-w4-53dcb1-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-10-30T12:48:22Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:48:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:48:40Z"}],"name":"5b7b766a72874acf9e8163ee483bc3d2370257bc288a07afd179471595fc5c6d","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"29924","uid":"decedee9-7c18-40fa-9fdf-f683b56ba33c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5b7b766a72874acf9e8163ee483bc3d2370257bc288a07afd179471595fc5c6d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:48:23Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:48:23Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5b7b766a72874acf9e8163ee483bc3d2370257bc288a07afd179471595fc5c6d"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5b7b766a72874acf9e8163ee483bc3d2370257bc288a07afd179471595fc5c6d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:29.424Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-53dcb1/distinct-2-w4-53dcb1-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-10-30T12:53:56Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-10-30T12:53:56Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"45d550c2-67fa-44e5-8533-84f6029289a6\"}":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{},"f:version":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:53:56Z"}],"name":"9daf1c7213c63158612c39c6292118e88db3ad9946191083ee2a5a5a42090281","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"45d550c2-67fa-44e5-8533-84f6029289a6"}],"resourceVersion":"42390","uid":"93a70bd1-99e5-4737-9f20-b84ccce5dff3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/f869b"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9daf1c7213c63158612c39c6292118e88db3ad9946191083ee2a5a5a42090281"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-53dcb1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-10-30T12:53:56Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-10-30T12:53:56Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9daf1c7213c63158612c39c6292118e88db3ad9946191083ee2a5a5a42090281"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9daf1c7213c63158612c39c6292118e88db3ad9946191083ee2a5a5a42090281\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:29.445Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny","namespace":"openshift-ingress","uid":"3ed0b548-54b3-4ca0-97cb-39f8824d0e4c","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:29.461Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-53dcb1","namespace":"e2e-models-e2e-worker-w4-53dcb1","uid":"c38bfaf5-f2e6-48ca-82c3-93e2f72b5b36","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-53dcb1\" not found"}
{"level":"error","ts":"2026-10-30T13:10:29.463Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w4-53dcb1-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w4-53dcb1-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:29.478Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"f97bdc32-b5c0-44fe-b3e8-9f6d2bf611ce","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:29.492Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w1-7a590a-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w1-7a590a-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:29.495Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-7a590a","namespace":"e2e-models-e2e-worker-w1-7a590a","uid":"22506f20-f506-4553-8ba6-858d31792325","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-7a590a\" not found"}
{"level":"error","ts":"2026-10-30T13:10:29.512Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-53dcb1","namespace":"e2e-models-e2e-worker-w4-53dcb1","uid":"1092f88c-7f1b-4d74-9ba7-b9b0fd959b68","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-53dcb1\" not found"}
{"level":"error","ts":"2026-10-30T13:10:29.528Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-worker-w1-7a590a","namespace":"openshift-ingress","uid":"a56a2bd0-df27-43de-8bc2-258da0283d97","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-worker-w1-7a590a\" not found"}
{"level":"error","ts":"2026-10-30T13:10:29.547Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-7a590a","namespace":"e2e-models-e2e-worker-w1-7a590a","uid":"f9af62f3-67ad-4018-8e68-d1b98a22aebf","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-7a590a\" not found"}
{"level":"error","ts":"2026-10-30T13:10:29.570Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-worker-w4-53dcb1","namespace":"openshift-ingress","uid":"52e3229d-606f-4db7-98bc-956f208ede10","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-worker-w4-53dcb1\" not found"}
{"level":"error","ts":"2026-10-30T13:10:29.594Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"b3c72654-a441-46eb-b600-8f86b5d68e10","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.595Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-10-30T13:10:29.595Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-10-30T13:10:29Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w1-7a590a","event":"UPDATE"}
{"level":"info","ts":"2026-10-30T13:10:29Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-10-30T13:10:29Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-10-30T13:10:29Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-10-30T13:10:29.699Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w4-53dcb1","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w4-53dcb1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-10-30T13:10:29Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w1-7a590a","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w1-7a590a","reconcileID":"6ac5cb81-5f2a-461d-a165-d301f6e409a6","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-worker-w1-7a590a","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-10-30T13:10:29Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w1-7a590a","event":"DELETE"}
{"level":"info","ts":"2026-10-30T13:10:29Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-10-30T13:10:29Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-worker-w1-7a590a\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:445\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.23.3/pkg/internal/controller/controller.go:222\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.23.3/pkg/internal/controller/controller.go:479\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.23.3/pkg/internal/controller/controller.go:438\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func1.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.23.3/pkg/internal/controller/controller.go:313"}
{"level":"info","ts":"2026-10-30T13:10:29Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-10-30T13:10:29.780Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w1-7a590a","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w1-7a590a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/c92a5de0eff7788429bc28fdec8d86609bf02b5fbedce82308479d1706288bec","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c92a5de0eff7788429bc28fdec8d86609bf02b5fbedce82308479d1706288bec\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/8013b4888d8c0c89f4fb91ca2c345624f24083cc7b8ea83841c85560e17fd789","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8013b4888d8c0c89f4fb91ca2c345624f24083cc7b8ea83841c85560e17fd789\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/9d94bdb074cd59e0eeb52465f57a2886f3010a3084bca915240c377dfa69371d","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9d94bdb074cd59e0eeb52465f57a2886f3010a3084bca915240c377dfa69371d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/866ba8602385aeaa90e8ae78ada1be9ce63dd09727bf4ecc6c1fa758e828a9bd","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"866ba8602385aeaa90e8ae78ada1be9ce63dd09727bf4ecc6c1fa758e828a9bd\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/0adc57d51b35181d57ce7070149cb9dcb5a1c35659398baa1c2c66f130cf379f","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0adc57d51b35181d57ce7070149cb9dcb5a1c35659398baa1c2c66f130cf379f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/81e7bc6ff15c5fcf552436509b25c7dfb574a74e08c2e48ee54b9755f92fa90a","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"81e7bc6ff15c5fcf552436509b25c7dfb574a74e08c2e48ee54b9755f92fa90a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"IstioExtensionReconciler","operation":"update","resource":"openshift-ingress/kuadrant-e2e-worker-w4-53dcb1","kind":"EnvoyFilter.networking.istio.io","error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w4-53dcb1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/2906b56422a5d1e18029f8dfe9f583868b1f6413dbb86a0e4489258e2491aee2","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2906b56422a5d1e18029f8dfe9f583868b1f6413dbb86a0e4489258e2491aee2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/ce573b3027ad9607006464b4e16f49dcac328bda3098dc2f9cbf0de48aa9d1a3","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ce573b3027ad9607006464b4e16f49dcac328bda3098dc2f9cbf0de48aa9d1a3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/eceaa3373eca8aa1fa797e413753c17981f4395ea7c9e6478abf3dbb81e8216b","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"eceaa3373eca8aa1fa797e413753c17981f4395ea7c9e6478abf3dbb81e8216b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/d15c406a43328781f512c3e6de986a018b3122ac39a7a4cbc136e998b2b48492","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d15c406a43328781f512c3e6de986a018b3122ac39a7a4cbc136e998b2b48492\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/4917cb32e7b2094a58f1559c0d805212c1f0a354154ff0d6718a8463e5565d99","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4917cb32e7b2094a58f1559c0d805212c1f0a354154ff0d6718a8463e5565d99\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/46fc87d721087034978051b991603b15a1549a42ffd6a9f2d7540fa624d9fbe0","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"46fc87d721087034978051b991603b15a1549a42ffd6a9f2d7540fa624d9fbe0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/b444fff7c731702df9c43dd18a342ed5f4b84acbd2ae2c04e246e2ddadc11c94","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b444fff7c731702df9c43dd18a342ed5f4b84acbd2ae2c04e246e2ddadc11c94\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/4e43587797a9f0e99f41485cc6382657fd275bc0456caa79ddfb81c0a3829ce8","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4e43587797a9f0e99f41485cc6382657fd275bc0456caa79ddfb81c0a3829ce8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/750010eae93e29ff523a99ba4e5ef57554664f3213920e75c1959e2db0176128","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"750010eae93e29ff523a99ba4e5ef57554664f3213920e75c1959e2db0176128\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/2a63b0542f7d5e9ab21ff2a70e875d9016c654a34be4af8b2862093443d15c51","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2a63b0542f7d5e9ab21ff2a70e875d9016c654a34be4af8b2862093443d15c51\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/19bfec94f9532ea4b5b1ff4e22e34dccda05f7858053828e2a904551707f45dc","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"19bfec94f9532ea4b5b1ff4e22e34dccda05f7858053828e2a904551707f45dc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/74883f5b7e7a852327e008c7e9f03a1d91f98325beeb19c446f62796e6aef8d1","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"74883f5b7e7a852327e008c7e9f03a1d91f98325beeb19c446f62796e6aef8d1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/b457a46f3c297a562935e2446d9043cdc1001219a34f31aa169362f32a741476","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b457a46f3c297a562935e2446d9043cdc1001219a34f31aa169362f32a741476\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/774123679310f86a6cee928712e1340beda60d2cfd92fbbd2c0879a79005ee42","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"774123679310f86a6cee928712e1340beda60d2cfd92fbbd2c0879a79005ee42\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/dde723c1559b7f93ce7e2cffbcf1cf349ad8c296646082c81a7499be56862cd1","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"dde723c1559b7f93ce7e2cffbcf1cf349ad8c296646082c81a7499be56862cd1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/daeca0bfe6a614d446a745f7a44cc67f378c849fbedaa1026e4914166e275650","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"daeca0bfe6a614d446a745f7a44cc67f378c849fbedaa1026e4914166e275650\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/7cd969c2f8771fba44a7e483980f071aa82ff99f59db04390ca78ff143e778c0","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7cd969c2f8771fba44a7e483980f071aa82ff99f59db04390ca78ff143e778c0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/e3eeda6dee0071c64c151bbb71350df5353b1c91473127cebe525b54a04ae2cc","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e3eeda6dee0071c64c151bbb71350df5353b1c91473127cebe525b54a04ae2cc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/671fede733c21121c0fa91b5b6cadbeceb86fb48425b13fa2b5f9d78803a82f0","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"671fede733c21121c0fa91b5b6cadbeceb86fb48425b13fa2b5f9d78803a82f0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/cdf3e72f09d9c23ed7de62e42d53e35a45b58ea6979b92283ba6e44040223a64","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"cdf3e72f09d9c23ed7de62e42d53e35a45b58ea6979b92283ba6e44040223a64\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/1e238b7d9e3f5d63d4bb1b2c1e20a3b8446c915d602f4a498ff5e32b26494ce9","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1e238b7d9e3f5d63d4bb1b2c1e20a3b8446c915d602f4a498ff5e32b26494ce9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/10edd1ae6c0df8a5a1b0594a6fb7b99897fa2d890c87aa6828ecbf4c438a7e03","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"10edd1ae6c0df8a5a1b0594a6fb7b99897fa2d890c87aa6828ecbf4c438a7e03\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/05daa6d986fd5a49c2023f2b7516d814e699fceafa44c99344553fea00c14848","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"05daa6d986fd5a49c2023f2b7516d814e699fceafa44c99344553fea00c14848\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/4f9ad3ea2cb0afdd240e7a999cacd6f99c830a43e8d5ae688123da58c428bec2","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4f9ad3ea2cb0afdd240e7a999cacd6f99c830a43e8d5ae688123da58c428bec2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/82a9c25434b61c4772a1ac29246cbb75b1b553266861c57cdeeb5d939581bbaa","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"82a9c25434b61c4772a1ac29246cbb75b1b553266861c57cdeeb5d939581bbaa\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/3a378a4162f02d06b635ffcd9cd97fb7c9975eac68f0d956efd8c3576a6c096c","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3a378a4162f02d06b635ffcd9cd97fb7c9975eac68f0d956efd8c3576a6c096c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/a5785a5c9d1c12ba13cd603c475c38ef808a12f3823a420b722dc3d70a23c624","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a5785a5c9d1c12ba13cd603c475c38ef808a12f3823a420b722dc3d70a23c624\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/f1891bb22a9e5664f3026841b58d9ab6c8ff3d4c1597f502e3c8daf82fd67c78","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f1891bb22a9e5664f3026841b58d9ab6c8ff3d4c1597f502e3c8daf82fd67c78\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/e9a145d980170d0288208e686227f27cf4330221d68aa965fa696259630442c4","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e9a145d980170d0288208e686227f27cf4330221d68aa965fa696259630442c4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/8a140385139e5d1094af15ad091323d3ab199555833d87f4aab24de3d072b6e1","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8a140385139e5d1094af15ad091323d3ab199555833d87f4aab24de3d072b6e1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/1cc8f595efea76e0d3eedd32969d77ea8835ab68928410c6c8b033bf46f72923","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1cc8f595efea76e0d3eedd32969d77ea8835ab68928410c6c8b033bf46f72923\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/d23d6b45289810b57bcf4421cc3f6d7a9b00af854de8d617d6f29562dd513117","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d23d6b45289810b57bcf4421cc3f6d7a9b00af854de8d617d6f29562dd513117\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/55e675544ade227ac183e9688220aab677d3e3a4d82332e06ed1f425d673a304","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"55e675544ade227ac183e9688220aab677d3e3a4d82332e06ed1f425d673a304\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/17173ba26c2e665c9e0e4ef6ffc67fd759e864382b5cbe50edc98a2bdae7ddd4","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"17173ba26c2e665c9e0e4ef6ffc67fd759e864382b5cbe50edc98a2bdae7ddd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/068abb543fe2d8904c85c4227e66d1127808e1da52374db674dc113c87dc522c","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"068abb543fe2d8904c85c4227e66d1127808e1da52374db674dc113c87dc522c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/9a0f225cd047dcdb3f4867b212ef3e6dec20d7e8a4fca7af06293fb5c507b2a9","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9a0f225cd047dcdb3f4867b212ef3e6dec20d7e8a4fca7af06293fb5c507b2a9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/b42d2ea2a5c62b1cba47bae62d396ed1c6451087f098340f79cc1ed15366e415","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b42d2ea2a5c62b1cba47bae62d396ed1c6451087f098340f79cc1ed15366e415\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/8c0cd107e1fa6f004c9af05b8c3102f19ebfd173ca67bf6c06fdd17256eaba05","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8c0cd107e1fa6f004c9af05b8c3102f19ebfd173ca67bf6c06fdd17256eaba05\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/f41fcbb289a766d6a29268d2be644d886254d678311240795320efb90fdad5eb","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f41fcbb289a766d6a29268d2be644d886254d678311240795320efb90fdad5eb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/23aab9fbc666b3e1b9b9e93c16a3f2a3603bc75c70d345208c83efb52c885c12","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"23aab9fbc666b3e1b9b9e93c16a3f2a3603bc75c70d345208c83efb52c885c12\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/3a4b1c0e3136e893a0ff6adebc7676449cb25c1230b5628462c88499dc931fae","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3a4b1c0e3136e893a0ff6adebc7676449cb25c1230b5628462c88499dc931fae\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/8bf7acafa93e755f68cfd59460e5a54df9f18ca04f2d003d86d0083de64598fe","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8bf7acafa93e755f68cfd59460e5a54df9f18ca04f2d003d86d0083de64598fe\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/b53dd5318f075895d6819e8d4ceffc9d62fa37419025365efad5d4c37c032ae2","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b53dd5318f075895d6819e8d4ceffc9d62fa37419025365efad5d4c37c032ae2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/50f9f35158468854257f3b1da534aee4a02c5f37c0b91fe1a72899c341660094","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"50f9f35158468854257f3b1da534aee4a02c5f37c0b91fe1a72899c341660094\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.811Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/104f9b7f51a3df1f9430904dedb3f7a4cf21c6cc4c20557200b5472ed316a34b","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"104f9b7f51a3df1f9430904dedb3f7a4cf21c6cc4c20557200b5472ed316a34b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/848ef614bc7f06bf3e510719cdaccc63c032f4baa9511a3271180a15243597be","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"848ef614bc7f06bf3e510719cdaccc63c032f4baa9511a3271180a15243597be\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/9daf1c7213c63158612c39c6292118e88db3ad9946191083ee2a5a5a42090281","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9daf1c7213c63158612c39c6292118e88db3ad9946191083ee2a5a5a42090281\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/282fb13e85739e757462864ee696b3b5e995491369e9a8b047440bf7e1681190","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"282fb13e85739e757462864ee696b3b5e995491369e9a8b047440bf7e1681190\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/8c4d0e21c666fd015a2db768ffb20bedac801efe539190c06ca7594e9010af8c","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8c4d0e21c666fd015a2db768ffb20bedac801efe539190c06ca7594e9010af8c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/035ae7b4aacac45527bf36277a7aad77aa4acceba99af38797fa4f951905ee54","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"035ae7b4aacac45527bf36277a7aad77aa4acceba99af38797fa4f951905ee54\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/1ae748d971f49d47d371205b68e94c4d734abb4b723a86bcb07504627759dc89","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1ae748d971f49d47d371205b68e94c4d734abb4b723a86bcb07504627759dc89\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/53525895e62d7603774165b95492f86a299a94e811b8bfa096068557dc3b7079","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"53525895e62d7603774165b95492f86a299a94e811b8bfa096068557dc3b7079\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/13caff03101ec8fb67cc6985c5efbc26b786120381d2d76f2515fdb6fe7706e9","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"13caff03101ec8fb67cc6985c5efbc26b786120381d2d76f2515fdb6fe7706e9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/2634d60d3fbc322f122dacc07b9e00083342e7efbe03e17bf65457a826752cf4","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2634d60d3fbc322f122dacc07b9e00083342e7efbe03e17bf65457a826752cf4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/b7432eac2809c3393fb8b46df502f39f77e27e5e88eff0e8835bfdb185fa9eef","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b7432eac2809c3393fb8b46df502f39f77e27e5e88eff0e8835bfdb185fa9eef\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/f0f1429576f1a1be321185e1bd6abb819aea50327fda0269d5612db65c382cfd","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f0f1429576f1a1be321185e1bd6abb819aea50327fda0269d5612db65c382cfd\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/5e2828e21483a361ca7af9667f8d2d5b6b368fff80e00b61868847aed179c479","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5e2828e21483a361ca7af9667f8d2d5b6b368fff80e00b61868847aed179c479\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/076a038410428b9ac2bad029581c01b28cffd7b7f1a64c56465ca488c625b3c5","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"076a038410428b9ac2bad029581c01b28cffd7b7f1a64c56465ca488c625b3c5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/4c7e28c4ea66d3867db6e2053d338fd95c76975fa4ce24e65e7850a19b58e263","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4c7e28c4ea66d3867db6e2053d338fd95c76975fa4ce24e65e7850a19b58e263\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/9ce8c2fa3380caeba39c62cfdb2e02b46776e4eac1f908f418140d9b7b883fe2","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9ce8c2fa3380caeba39c62cfdb2e02b46776e4eac1f908f418140d9b7b883fe2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/a8c66d50ffdf82d6ecae69a1c0971f324d61cb035754e672c09e1374920c130f","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a8c66d50ffdf82d6ecae69a1c0971f324d61cb035754e672c09e1374920c130f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/006181ea19644569eba45d273bd8a4fc3b9b2bd4ecbd3ef11fbb23f3a488daba","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"006181ea19644569eba45d273bd8a4fc3b9b2bd4ecbd3ef11fbb23f3a488daba\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"IstioExtensionReconciler","operation":"update","resource":"openshift-ingress/kuadrant-e2e-worker-w1-7a590a","kind":"EnvoyFilter.networking.istio.io","error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w1-7a590a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/6ef9659353658fa30f8a50bb13e2e8523254919072f9604a5929a5ceb0a6bc17","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6ef9659353658fa30f8a50bb13e2e8523254919072f9604a5929a5ceb0a6bc17\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/3f89ae75a20ba19970a54ccc348cc608ebfca7566239d4f9b158f43febd42e55","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3f89ae75a20ba19970a54ccc348cc608ebfca7566239d4f9b158f43febd42e55\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/054858abf03d49266e8b2b24aacaec6285f09f0adfa2239155a173261bdcca7c","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"054858abf03d49266e8b2b24aacaec6285f09f0adfa2239155a173261bdcca7c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/e85025d98da554ebf7c487d2062eb7fa47a1b3d6adb7b480115a5ce4cefb0483","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e85025d98da554ebf7c487d2062eb7fa47a1b3d6adb7b480115a5ce4cefb0483\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/8efe4c813ac88cde94cfd4bea026c778ccd1fc314df55d6fc5a83b02e37d153e","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8efe4c813ac88cde94cfd4bea026c778ccd1fc314df55d6fc5a83b02e37d153e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/ae63d00fa381b265866cb1b277633e2a155b94de180c6acefe93b77f7e35e7d3","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ae63d00fa381b265866cb1b277633e2a155b94de180c6acefe93b77f7e35e7d3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/22b1883b4b523fcb5aa2347e32fc0852b420c0da88d30eb8ccec885b0647939d","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"22b1883b4b523fcb5aa2347e32fc0852b420c0da88d30eb8ccec885b0647939d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/44fc74b91f49727f317f3fdebe4dddd5445c63c7601b59dbb817a847a2a1b2eb","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"44fc74b91f49727f317f3fdebe4dddd5445c63c7601b59dbb817a847a2a1b2eb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/f09d09fc6dde1d236524d4d6dcb928bdcf139e1b1ce84cce5a5a61d0dfbe9a0d","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f09d09fc6dde1d236524d4d6dcb928bdcf139e1b1ce84cce5a5a61d0dfbe9a0d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/1031e5fe412033da350814ac517fe44eb0eae32dbb531ffb2414912a07a0c15f","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1031e5fe412033da350814ac517fe44eb0eae32dbb531ffb2414912a07a0c15f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthPolicyStatusUpdater","operation":"update","resource":"openshift-ingress/e2e-worker-w1-7a590a-maas-auth","kind":"AuthPolicy.kuadrant.io","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w1-7a590a-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/eab745772fec776a6f0c7c817900ac89dcc6e3a8917a2bfb414cfb44d3d67989","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"eab745772fec776a6f0c7c817900ac89dcc6e3a8917a2bfb414cfb44d3d67989\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/15ff23dabc113f8de56339b254a90e582a84646a03e6621c05d53289f469023b","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"15ff23dabc113f8de56339b254a90e582a84646a03e6621c05d53289f469023b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/30449cf39f411e1cc4fa580c9f841e231a5d83f9d8c88b5c2dab8b705d0f2b52","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"30449cf39f411e1cc4fa580c9f841e231a5d83f9d8c88b5c2dab8b705d0f2b52\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/105f27cff377e7455202b357006b2ff9c435dd06d077a77766a438b920e65ecb","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"105f27cff377e7455202b357006b2ff9c435dd06d077a77766a438b920e65ecb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/df21e7cfc8f3ee440a1487e95ff0c570ae804b786dd01a0d794bd1f3a9985389","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"df21e7cfc8f3ee440a1487e95ff0c570ae804b786dd01a0d794bd1f3a9985389\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthPolicyStatusUpdater","operation":"update","resource":"openshift-ingress/e2e-worker-w4-53dcb1-maas-auth","kind":"AuthPolicy.kuadrant.io","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w4-53dcb1-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/9aa33d1f7ee5b6f87dfab107560c9553ff008f5f640805b76152726175c3c7a0","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9aa33d1f7ee5b6f87dfab107560c9553ff008f5f640805b76152726175c3c7a0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/9fcc31bf477a6a539b09c1dafa0d8c389f6af32511fb4c214235577254b96a22","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9fcc31bf477a6a539b09c1dafa0d8c389f6af32511fb4c214235577254b96a22\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/ebf2ac513888626165cd2d0790db586c2e4365bfc263ad07ac289ad50a7f0ae7","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ebf2ac513888626165cd2d0790db586c2e4365bfc263ad07ac289ad50a7f0ae7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/11d94353721e19c51aa0bc6aaf17a915f0c4bc5c5b03c6670c645da71e67b0ab","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"11d94353721e19c51aa0bc6aaf17a915f0c4bc5c5b03c6670c645da71e67b0ab\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/6ce786297e806878f759f8ebe30957c2bd515f34c8cd580c47396d68b73ee3d1","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6ce786297e806878f759f8ebe30957c2bd515f34c8cd580c47396d68b73ee3d1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/3ae6be995c08f6214b9af6f7ee2efd55d8f0b2fb8b2e04829e5955c670b7b74d","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3ae6be995c08f6214b9af6f7ee2efd55d8f0b2fb8b2e04829e5955c670b7b74d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/a149d9912ccbb2cd4dd7e07e1172f90c639e64a98b99b9a1967bc3c9bf5d8205","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a149d9912ccbb2cd4dd7e07e1172f90c639e64a98b99b9a1967bc3c9bf5d8205\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/c2af1523299b2ae906db2cfc1bc1eca9f96ff5bcf739238555d11eab67499efe","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c2af1523299b2ae906db2cfc1bc1eca9f96ff5bcf739238555d11eab67499efe\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/c2d72b7f90bb96f33e2e1b00416be5fdbcedf88bc9b8577dd76935f6319a4e60","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c2d72b7f90bb96f33e2e1b00416be5fdbcedf88bc9b8577dd76935f6319a4e60\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/d698cb3490c21dc5d10c6de9a6bc389ce436a75532ce382d151ae459332e57ee","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d698cb3490c21dc5d10c6de9a6bc389ce436a75532ce382d151ae459332e57ee\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/5b7b766a72874acf9e8163ee483bc3d2370257bc288a07afd179471595fc5c6d","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5b7b766a72874acf9e8163ee483bc3d2370257bc288a07afd179471595fc5c6d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/4c43f9d5f89223314ff24852e7f60990cdcffd391cae2e1728b63cb0cbd8e575","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4c43f9d5f89223314ff24852e7f60990cdcffd391cae2e1728b63cb0cbd8e575\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/d277167c1aa8cacaa4008b08884917c3bf967bff3e5581e0d555489ad3f97e24","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d277167c1aa8cacaa4008b08884917c3bf967bff3e5581e0d555489ad3f97e24\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/b7fd9eb41424bdbacdb2d2be398f7f3d33ee8577e46641724bb6c847f8a39b50","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b7fd9eb41424bdbacdb2d2be398f7f3d33ee8577e46641724bb6c847f8a39b50\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/ce47c00ef51de8c42dff484190186d5315e9812635a34ef8cbec474b4571879a","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ce47c00ef51de8c42dff484190186d5315e9812635a34ef8cbec474b4571879a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/06644eed28a6354f9d9cbd205635366137e6f9a985e0cdf1f830923dc4c32196","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"06644eed28a6354f9d9cbd205635366137e6f9a985e0cdf1f830923dc4c32196\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"update","resource":"kuadrant-system/96a10edf633153472e430c6c2106fabd9d088950913cb891f8d1131e8e85d5da","kind":"AuthConfig.authorino.kuadrant.io","error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"96a10edf633153472e430c6c2106fabd9d088950913cb891f8d1131e8e85d5da\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:29.812Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"scheduling retry for non-blocking errors","errorCount":113,"requeueAfter":2}
{"level":"info","ts":"2026-10-30T13:10:31.734Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","TokenRateLimitPolicy","EnvoyFilter","Limitador","AuthPolicy"],"eventTypes":{"update":8}}
{"level":"info","ts":"2026-10-30T13:10:31.785Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-10-30T13:10:31.785Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-10-30T13:10:31.831Z","logger":"kuadrant-operator.KuadrantController","msg":"triggering reconciliation retry for non-blocking errors","errorCount":113}
{"level":"info","ts":"2026-10-30T13:10:32.278Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-10-30T13:10:32.371Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-10-30T13:10:32.371Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-10-30T13:10:32.389Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-10-30T13:10:32.909Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-10-30T13:10:32.912Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-10-30T13:10:32.912Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-10-30T13:10:32.922Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-10-30T13:10:32.923Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-10-30T13:10:32.924Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-10-30T13:10:32.975Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-10-30T13:10:33.875Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T12:42:13Z","generation":32,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"13037da2-7ce3-408f-991b-ad31db53d1ff\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:44:45Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"13037da2-7ce3-408f-991b-ad31db53d1ff"}],"resourceVersion":"18597","uid":"044e9012-9183-4278-aac0-7fa080f81471"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"etcdserver: request is too large"}
{"level":"info","ts":"2026-10-30T13:10:35.624Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-10-30T13:10:35.624Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"max retry attempts reached, giving up","source":"IstioExtensionReconciler","operation":"update","resource":"openshift-ingress/kuadrant-maas-default-gateway","kind":"EnvoyFilter.networking.istio.io","attempts":5,"duration":24.55298243,"error":"etcdserver: request is too large"}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/0adc57d51b35181d57ce7070149cb9dcb5a1c35659398baa1c2c66f130cf379f/update","attempts":1,"duration":6.11287072}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/fc6e89efbfd966a7d75387ed2f2e7cc8e1760cc7321fa49392826390eefcb9c8/update","attempts":1,"duration":6.112442202}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/d698cb3490c21dc5d10c6de9a6bc389ce436a75532ce382d151ae459332e57ee/update","attempts":1,"duration":6.112071887}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/06644eed28a6354f9d9cbd205635366137e6f9a985e0cdf1f830923dc4c32196/update","attempts":1,"duration":6.112030613}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/8a140385139e5d1094af15ad091323d3ab199555833d87f4aab24de3d072b6e1/update","attempts":1,"duration":6.112599566}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/c92a5de0eff7788429bc28fdec8d86609bf02b5fbedce82308479d1706288bec/update","attempts":1,"duration":6.112961111}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/4f9ad3ea2cb0afdd240e7a999cacd6f99c830a43e8d5ae688123da58c428bec2/update","attempts":1,"duration":6.112656034}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/068abb543fe2d8904c85c4227e66d1127808e1da52374db674dc113c87dc522c/update","attempts":1,"duration":6.112556429}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/f41fcbb289a766d6a29268d2be644d886254d678311240795320efb90fdad5eb/update","attempts":1,"duration":6.112530553}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/b7432eac2809c3393fb8b46df502f39f77e27e5e88eff0e8835bfdb185fa9eef/update","attempts":1,"duration":6.112386578}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/9ce8c2fa3380caeba39c62cfdb2e02b46776e4eac1f908f418140d9b7b883fe2/update","attempts":1,"duration":6.112354007}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/c2d72b7f90bb96f33e2e1b00416be5fdbcedf88bc9b8577dd76935f6319a4e60/update","attempts":1,"duration":6.112130455}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/19bfec94f9532ea4b5b1ff4e22e34dccda05f7858053828e2a904551707f45dc/update","attempts":1,"duration":6.112804571}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/daeca0bfe6a614d446a745f7a44cc67f378c849fbedaa1026e4914166e275650/update","attempts":1,"duration":6.112762427}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"EnvoyFilter.networking.istio.io/openshift-ingress/kuadrant-e2e-worker-w1-7a590a/update","attempts":1,"duration":6.112350728}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/f1891bb22a9e5664f3026841b58d9ab6c8ff3d4c1597f502e3c8daf82fd67c78/update","attempts":1,"duration":6.112667766}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/55e675544ade227ac183e9688220aab677d3e3a4d82332e06ed1f425d673a304/update","attempts":1,"duration":6.112621691}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/46fc87d721087034978051b991603b15a1549a42ffd6a9f2d7540fa624d9fbe0/update","attempts":1,"duration":6.112873172}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/774123679310f86a6cee928712e1340beda60d2cfd92fbbd2c0879a79005ee42/update","attempts":1,"duration":6.112801651}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/50f9f35158468854257f3b1da534aee4a02c5f37c0b91fe1a72899c341660094/update","attempts":1,"duration":6.112543128}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/d23d6b45289810b57bcf4421cc3f6d7a9b00af854de8d617d6f29562dd513117/update","attempts":1,"duration":6.112650407}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/e4d4314df93127959066c4ed57aeadca6069ea351bc1d74511e16744968d8959/update","attempts":1,"duration":6.112330047}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/4e43587797a9f0e99f41485cc6382657fd275bc0456caa79ddfb81c0a3829ce8/update","attempts":1,"duration":6.112874879}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/05daa6d986fd5a49c2023f2b7516d814e699fceafa44c99344553fea00c14848/update","attempts":1,"duration":6.112747422}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/5e2828e21483a361ca7af9667f8d2d5b6b368fff80e00b61868847aed179c479/update","attempts":1,"duration":6.112441987}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/f09d09fc6dde1d236524d4d6dcb928bdcf139e1b1ce84cce5a5a61d0dfbe9a0d/update","attempts":1,"duration":6.112325787}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/23aab9fbc666b3e1b9b9e93c16a3f2a3603bc75c70d345208c83efb52c885c12/update","attempts":1,"duration":6.112606418}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/b7fd9eb41424bdbacdb2d2be398f7f3d33ee8577e46641724bb6c847f8a39b50/update","attempts":1,"duration":6.112160446}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/750010eae93e29ff523a99ba4e5ef57554664f3213920e75c1959e2db0176128/update","attempts":1,"duration":6.112895767}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/cdf3e72f09d9c23ed7de62e42d53e35a45b58ea6979b92283ba6e44040223a64/update","attempts":1,"duration":6.11280136}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/9daf1c7213c63158612c39c6292118e88db3ad9946191083ee2a5a5a42090281/update","attempts":1,"duration":6.112555573}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/b457a46f3c297a562935e2446d9043cdc1001219a34f31aa169362f32a741476/update","attempts":1,"duration":6.112871233}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/b53dd5318f075895d6819e8d4ceffc9d62fa37419025365efad5d4c37c032ae2/update","attempts":1,"duration":6.112612626}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/e85025d98da554ebf7c487d2062eb7fa47a1b3d6adb7b480115a5ce4cefb0483/update","attempts":1,"duration":6.112411834}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/8013b4888d8c0c89f4fb91ca2c345624f24083cc7b8ea83841c85560e17fd789/update","attempts":1,"duration":6.113068299}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/81e7bc6ff15c5fcf552436509b25c7dfb574a74e08c2e48ee54b9755f92fa90a/update","attempts":1,"duration":6.113038147}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/2a63b0542f7d5e9ab21ff2a70e875d9016c654a34be4af8b2862093443d15c51/update","attempts":1,"duration":6.112928781}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/8bf7acafa93e755f68cfd59460e5a54df9f18ca04f2d003d86d0083de64598fe/update","attempts":1,"duration":6.112662393}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/054858abf03d49266e8b2b24aacaec6285f09f0adfa2239155a173261bdcca7c/update","attempts":1,"duration":6.112459951}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/b8b5b35db7b2ba4690015e54a28710b1b7db14be727d8ad69bda274f885e11b3/update","attempts":1,"duration":6.112943176}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/1e238b7d9e3f5d63d4bb1b2c1e20a3b8446c915d602f4a498ff5e32b26494ce9/update","attempts":1,"duration":6.112862701}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/3a4b1c0e3136e893a0ff6adebc7676449cb25c1230b5628462c88499dc931fae/update","attempts":1,"duration":6.112689101}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/3ae6be995c08f6214b9af6f7ee2efd55d8f0b2fb8b2e04829e5955c670b7b74d/update","attempts":1,"duration":6.112318818}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/5b7b766a72874acf9e8163ee483bc3d2370257bc288a07afd179471595fc5c6d/update","attempts":1,"duration":6.112278746}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/a5785a5c9d1c12ba13cd603c475c38ef808a12f3823a420b722dc3d70a23c624/update","attempts":1,"duration":6.112832329}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/104f9b7f51a3df1f9430904dedb3f7a4cf21c6cc4c20557200b5472ed316a34b/update","attempts":1,"duration":6.112661083}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/ae63d00fa381b265866cb1b277633e2a155b94de180c6acefe93b77f7e35e7d3/update","attempts":1,"duration":6.112475397}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/13caff03101ec8fb67cc6985c5efbc26b786120381d2d76f2515fdb6fe7706e9/update","attempts":1,"duration":6.11260134}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/30449cf39f411e1cc4fa580c9f841e231a5d83f9d8c88b5c2dab8b705d0f2b52/update","attempts":1,"duration":6.112416792}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"EnvoyFilter.networking.istio.io/openshift-ingress/kuadrant-e2e-worker-w4-53dcb1/update","attempts":1,"duration":6.11311241}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/671fede733c21121c0fa91b5b6cadbeceb86fb48425b13fa2b5f9d78803a82f0/update","attempts":1,"duration":6.112933522}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/3a378a4162f02d06b635ffcd9cd97fb7c9975eac68f0d956efd8c3576a6c096c/update","attempts":1,"duration":6.112873771}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/848ef614bc7f06bf3e510719cdaccc63c032f4baa9511a3271180a15243597be/update","attempts":1,"duration":6.112687347}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/282fb13e85739e757462864ee696b3b5e995491369e9a8b047440bf7e1681190/update","attempts":1,"duration":6.112675864}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/44fc74b91f49727f317f3fdebe4dddd5445c63c7601b59dbb817a847a2a1b2eb/update","attempts":1,"duration":6.112491191}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/df21e7cfc8f3ee440a1487e95ff0c570ae804b786dd01a0d794bd1f3a9985389/update","attempts":1,"duration":6.112434671}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/ebf2ac513888626165cd2d0790db586c2e4365bfc263ad07ac289ad50a7f0ae7/update","attempts":1,"duration":6.112408875}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/9a0f225cd047dcdb3f4867b212ef3e6dec20d7e8a4fca7af06293fb5c507b2a9/update","attempts":1,"duration":6.112805445}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/6ef9659353658fa30f8a50bb13e2e8523254919072f9604a5929a5ceb0a6bc17/update","attempts":1,"duration":6.112571409}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/82a9c25434b61c4772a1ac29246cbb75b1b553266861c57cdeeb5d939581bbaa/update","attempts":1,"duration":6.112919404}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/a8c66d50ffdf82d6ecae69a1c0971f324d61cb035754e672c09e1374920c130f/update","attempts":1,"duration":6.112602933}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthPolicy.kuadrant.io/openshift-ingress/e2e-worker-w1-7a590a-maas-auth/update","attempts":1,"duration":6.112501505}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/e61c9d40b0f5dac07dab5d1cb38eb2451645316ef4df9d1156b5d58fe7f6e103/update","attempts":1,"duration":6.11238416}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/8c0cd107e1fa6f004c9af05b8c3102f19ebfd173ca67bf6c06fdd17256eaba05/update","attempts":1,"duration":6.112817711}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/f0f1429576f1a1be321185e1bd6abb819aea50327fda0269d5612db65c382cfd/update","attempts":1,"duration":6.112658575}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/3f89ae75a20ba19970a54ccc348cc608ebfca7566239d4f9b158f43febd42e55/update","attempts":1,"duration":6.112595509}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/8efe4c813ac88cde94cfd4bea026c778ccd1fc314df55d6fc5a83b02e37d153e/update","attempts":1,"duration":6.112577362}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/6ce786297e806878f759f8ebe30957c2bd515f34c8cd580c47396d68b73ee3d1/update","attempts":1,"duration":6.112444296}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/dde723c1559b7f93ce7e2cffbcf1cf349ad8c296646082c81a7499be56862cd1/update","attempts":1,"duration":6.113049007}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/1031e5fe412033da350814ac517fe44eb0eae32dbb531ffb2414912a07a0c15f/update","attempts":1,"duration":6.1125457}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthPolicy.kuadrant.io/openshift-ingress/e2e-worker-w4-53dcb1-maas-auth/update","attempts":1,"duration":6.112496783}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/74883f5b7e7a852327e008c7e9f03a1d91f98325beeb19c446f62796e6aef8d1/update","attempts":1,"duration":6.113086595}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/2634d60d3fbc322f122dacc07b9e00083342e7efbe03e17bf65457a826752cf4/update","attempts":1,"duration":6.112711072}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/9d94bdb074cd59e0eeb52465f57a2886f3010a3084bca915240c377dfa69371d/update","attempts":1,"duration":6.113260635}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/b444fff7c731702df9c43dd18a342ed5f4b84acbd2ae2c04e246e2ddadc11c94/update","attempts":1,"duration":6.113152707}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/e9a145d980170d0288208e686227f27cf4330221d68aa965fa696259630442c4/update","attempts":1,"duration":6.112963941}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/392fd3e49d3deb33d0d7a4a486f44cecdb436c3b35865d1b2b3dabc5db381650/update","attempts":1,"duration":6.112910469}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/15ff23dabc113f8de56339b254a90e582a84646a03e6621c05d53289f469023b/update","attempts":1,"duration":6.112561604}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/105f27cff377e7455202b357006b2ff9c435dd06d077a77766a438b920e65ecb/update","attempts":1,"duration":6.112551184}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/866ba8602385aeaa90e8ae78ada1be9ce63dd09727bf4ecc6c1fa758e828a9bd/update","attempts":1,"duration":6.113280514}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/7cd969c2f8771fba44a7e483980f071aa82ff99f59db04390ca78ff143e778c0/update","attempts":1,"duration":6.113092004}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/035ae7b4aacac45527bf36277a7aad77aa4acceba99af38797fa4f951905ee54/update","attempts":1,"duration":6.112792728}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/ce47c00ef51de8c42dff484190186d5315e9812635a34ef8cbec474b4571879a/update","attempts":1,"duration":6.112433737}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/e3eeda6dee0071c64c151bbb71350df5353b1c91473127cebe525b54a04ae2cc/update","attempts":1,"duration":6.113097295}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/effdb5877808cb738b5758105199b1a28325ecaa2828ef782dcb63045c822c28/update","attempts":1,"duration":6.112991389}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/eceaa3373eca8aa1fa797e413753c17981f4395ea7c9e6478abf3dbb81e8216b/update","attempts":1,"duration":6.113250773}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/1cc8f595efea76e0d3eedd32969d77ea8835ab68928410c6c8b033bf46f72923/update","attempts":1,"duration":6.112993354}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/4c7e28c4ea66d3867db6e2053d338fd95c76975fa4ce24e65e7850a19b58e263/update","attempts":1,"duration":6.112746447}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/ce573b3027ad9607006464b4e16f49dcac328bda3098dc2f9cbf0de48aa9d1a3/update","attempts":1,"duration":6.113273238}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/d15c406a43328781f512c3e6de986a018b3122ac39a7a4cbc136e998b2b48492/update","attempts":1,"duration":6.11325}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/4917cb32e7b2094a58f1559c0d805212c1f0a354154ff0d6718a8463e5565d99/update","attempts":1,"duration":6.113246858}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/8c4d0e21c666fd015a2db768ffb20bedac801efe539190c06ca7594e9010af8c/update","attempts":1,"duration":6.112848388}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/9aa33d1f7ee5b6f87dfab107560c9553ff008f5f640805b76152726175c3c7a0/update","attempts":1,"duration":6.112595139}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/11d94353721e19c51aa0bc6aaf17a915f0c4bc5c5b03c6670c645da71e67b0ab/update","attempts":1,"duration":6.112576675}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/c2af1523299b2ae906db2cfc1bc1eca9f96ff5bcf739238555d11eab67499efe/update","attempts":1,"duration":6.112551603}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/96a10edf633153472e430c6c2106fabd9d088950913cb891f8d1131e8e85d5da/update","attempts":1,"duration":6.112471858}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/b42d2ea2a5c62b1cba47bae62d396ed1c6451087f098340f79cc1ed15366e415/update","attempts":1,"duration":6.11298344}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/1ae748d971f49d47d371205b68e94c4d734abb4b723a86bcb07504627759dc89/update","attempts":1,"duration":6.112861868}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/22b1883b4b523fcb5aa2347e32fc0852b420c0da88d30eb8ccec885b0647939d/update","attempts":1,"duration":6.112708086}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/465b61e9a39bf3d0bf44a456dc09cbe2bdde378f33f7a313db35c1b5204829a9/update","attempts":1,"duration":6.112855846}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/006181ea19644569eba45d273bd8a4fc3b9b2bd4ecbd3ef11fbb23f3a488daba/update","attempts":1,"duration":6.112785632}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/2906b56422a5d1e18029f8dfe9f583868b1f6413dbb86a0e4489258e2491aee2/update","attempts":1,"duration":6.113351349}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/37f9fbcad44c6bf76954f9dc66f0d244d4b5d81e2335ad08e14c4bbdb46d52fd/update","attempts":1,"duration":6.113346915}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/17173ba26c2e665c9e0e4ef6ffc67fd759e864382b5cbe50edc98a2bdae7ddd4/update","attempts":1,"duration":6.113046188}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/a149d9912ccbb2cd4dd7e07e1172f90c639e64a98b99b9a1967bc3c9bf5d8205/update","attempts":1,"duration":6.112605678}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/4c43f9d5f89223314ff24852e7f60990cdcffd391cae2e1728b63cb0cbd8e575/update","attempts":1,"duration":6.112565787}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/10edd1ae6c0df8a5a1b0594a6fb7b99897fa2d890c87aa6828ecbf4c438a7e03/update","attempts":1,"duration":6.11316856}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/53525895e62d7603774165b95492f86a299a94e811b8bfa096068557dc3b7079/update","attempts":1,"duration":6.112901095}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/076a038410428b9ac2bad029581c01b28cffd7b7f1a64c56465ca488c625b3c5/update","attempts":1,"duration":6.112853386}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/eab745772fec776a6f0c7c817900ac89dcc6e3a8917a2bfb414cfb44d3d67989/update","attempts":1,"duration":6.112720436}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/9fcc31bf477a6a539b09c1dafa0d8c389f6af32511fb4c214235577254b96a22/update","attempts":1,"duration":6.112671855}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/d277167c1aa8cacaa4008b08884917c3bf967bff3e5581e0d555489ad3f97e24/update","attempts":1,"duration":6.112585841}
{"level":"info","ts":"2026-10-30T13:10:35.924Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"all non-blocking errors have exceeded max retry attempts","errorCount":0}
{"level":"info","ts":"2026-10-30T13:10:35.980Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","TokenRateLimitPolicy","EnvoyFilter","ConfigMap"],"eventTypes":{"update":6}}
{"level":"info","ts":"2026-10-30T13:10:36.009Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-10-30T13:10:36.021Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-10-30T13:10:36.513Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-10-30T13:10:36.521Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-10-30T13:10:36.589Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-10-30T13:10:36.589Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-10-30T13:10:37.207Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-10-30T13:10:37.209Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-10-30T13:10:37.210Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-10-30T13:10:37.211Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-10-30T13:10:37.214Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-10-30T13:10:37.234Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:37.234Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-10-30T13:10:38.107Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T12:42:13Z","generation":32,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"13037da2-7ce3-408f-991b-ad31db53d1ff\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T12:44:45Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"13037da2-7ce3-408f-991b-ad31db53d1ff"}],"resourceVersion":"18597","uid":"044e9012-9183-4278-aac0-7fa080f81471"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"etcdserver: request is too large"}
{"level":"error","ts":"2026-10-30T13:10:38.133Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny","namespace":"openshift-ingress","uid":"3ed0b548-54b3-4ca0-97cb-39f8824d0e4c","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:38.147Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"b3c72654-a441-46eb-b600-8f86b5d68e10","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:38.168Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"f97bdc32-b5c0-44fe-b3e8-9f6d2bf611ce","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:38.172Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-10-30T13:10:38.172Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-10-30T13:10:38.196Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-2-w1-7a590a-kserve-route","namespace":"e2e-models-e2e-worker-w1-7a590a","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-2-w1-7a590a-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:38.205Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w4-53dcb1","error":"gateways.gateway.networking.k8s.io \"e2e-worker-w4-53dcb1\" not found"}
{"level":"error","ts":"2026-10-30T13:10:38.216Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"simulator-w4-53dcb1-kserve-route","namespace":"e2e-models-e2e-worker-w4-53dcb1","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"simulator-w4-53dcb1-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:38.218Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w1-7a590a","error":"gateways.gateway.networking.k8s.io \"e2e-worker-w1-7a590a\" not found"}
{"level":"error","ts":"2026-10-30T13:10:38.239Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"premium-w4-53dcb1-kserve-route","namespace":"e2e-models-e2e-worker-w4-53dcb1","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"premium-w4-53dcb1-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:38.265Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"simulator-w1-7a590a-kserve-route","namespace":"e2e-models-e2e-worker-w1-7a590a","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"simulator-w1-7a590a-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:38.293Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"premium-w1-7a590a-kserve-route","namespace":"e2e-models-e2e-worker-w1-7a590a","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"premium-w1-7a590a-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:38.313Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-w4-53dcb1-kserve-route","namespace":"e2e-models-e2e-worker-w4-53dcb1","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-w4-53dcb1-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:38.336Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-w1-7a590a-kserve-route","namespace":"e2e-models-e2e-worker-w1-7a590a","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-w1-7a590a-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-10-30T13:10:38.365Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-2-w4-53dcb1-kserve-route","namespace":"e2e-models-e2e-worker-w4-53dcb1","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-2-w4-53dcb1-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:38.365Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"LimitadorLimitsReconciler","operation":"update","resource":"kuadrant-system/limitador","kind":"Limitador.limitador.kuadrant.io","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-10-30T13:10:38.365Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"IstioExtensionReconciler","operation":"update","resource":"openshift-ingress/kuadrant-maas-default-gateway","kind":"EnvoyFilter.networking.istio.io","error":"etcdserver: request is too large"}
{"level":"info","ts":"2026-10-30T13:10:38.365Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"scheduling retry for non-blocking errors","errorCount":2,"requeueAfter":2}
{"level":"info","ts":"2026-10-30T13:10:39.636Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","Kuadrant","TokenRateLimitPolicy","HTTPRoute","AuthPolicy","Gateway","EnvoyFilter","ConfigMap","Limitador"],"eventTypes":{"create":26,"delete":31,"update":125}}
{"level":"info","ts":"2026-10-30T13:10:39.663Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-10-30T13:10:39.675Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-10-30T13:10:39.715Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-10-30T13:10:39.800Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-10-30T13:10:39.887Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-10-30T13:10:39.887Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-10-30T13:10:39.887Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}